Workflows, trust, and recovery
Handle approvals, failures, and handoffs
For teams whose agents take real actions that a person has to approve, recover from, or pick up halfway.
Once an agent takes real actions, most of the design work sits around the action itself: asking a person to approve it, getting back on track when it fails, and passing the work on partway through. These guides start with scoping one bounded workflow. Then they cover approvals where what the person approves is what actually runs, error responses that say whether a retry is safe, retries a team can see, and handoffs that carry the reason for the work along with the work. The last guide collects the recurring patterns in one place.
The guides, in order
Agent workflow design: scoping the first one
A bounded workflow with a real edge shows you where judgement, context and control matter.
7 min read
Agent context handoff: carry the reason for the work
Five things vanish at a handoff. A small structured record keeps intent, constraints, changed state, authority and evidence together.
8 min read
Human approval workflows for AI agents
Consequential actions need a clear pause, real choices, and a way back into the work.
24 min read
Agent error recovery: design the path back
Four fields turn an error into a decision: what failed, whether state changed, whether a retry is safe, and what input would fix it.
8 min read
Record retries as product history
Visible attempts show whether a system recovered cleanly or made people do more work.
8 min read
Approval, handoff and recovery patterns for AI agents
Seventeen named patterns for the human side of agent work, each with when to use it, how it fails and a live example.
21 min read
Rules on these topics
No side-effect annotations
The tool declares no readOnlyHint or destructiveHint, so clients fall back to the cautious defaults.
No dry-run flag documented
Help documents no --dry-run or equivalent, so an agent cannot rehearse a change before making it.
openWorldHint false for a tool that reaches outside
openWorldHint is false while the name or first sentence mentions the web, a URL, email, a webhook or a third party.
Side-effect annotation contradicts the description
readOnlyHint is true, or destructiveHint is false, while the opening verb of the description (or of the name) says it deletes, sends, creates or changes something.
Command hangs without a terminal
A probe did not finish within the timeout with no TTY, which usually means it is waiting for input.
Error text not on stderr
On an error, the message went to stdout and stderr was empty, so it mixes with output a script or agent parses.
Evidence on these topics
A CLI exits 0 when a destructive command is refused
Cloudflare's cf CLI documents that in a non-interactive session a destructive command without --force prints 'Aborted.' and exits with status 0, and a public issue reproduces this for workflows delete.
Idempotency keys cut duplicate writes from 28% to 4%
LIMBO (preprint) reports that offering an idempotency key on every write cut duplicate side effects from 28% to 4% of episodes because agents use keys when they exist, and that agents reported success in 90% of the episodes in which they had duplicated an effect.
An evidence contract cuts false-success reports after tool failures
Failure-Transparent Agents (preprint) reports that after a required tool failed, six models falsely reported success in 22.8% of responses by default, 9.3% with a transparency instruction and 0.8% with a structured evidence contract.
Dry-run output printed secrets until a fix redacted them
An issue on Cloudflare's cf beta reported that --dry-run printed secret values in plain text, and Cloudflare merged a fix redacting sensitive values in dry-run output on 5 October 2026.
Allow/ask/never policies blocked less overreach than per-action approval
In a study of 113 people without software backgrounds (preprint), user-authored allow/ask/never policies blocked 20.1 percentage points less agent overreach than per-action approval, partly because participants chose 'ask' for 114 of 140 rules and then approved most overreach at runtime.
Approvals that outlive their task raise attack success
A preprint reports that approvals persisted beyond the context that justified them raised prompt-injection attack success by up to 35.1 percentage points on 508 AgentDojo cases, and by 24.9 points on average in live tests on three production coding agents.