Skip to main content

Reliability: HITL Checkpoints

4. HITL Checkpoints: Stop Bad State from Propagating​

Use this lever when a wrong assumption would be expensive downstream: before implementation commits to a flawed plan, before scope expands into an unrequested refactor, or before an irreversible external action.

The operator move is a deliberate gate around a compact artifact:

  • a short plan before implementation
  • a spec before code changes
  • a diff summary before merge
  • a deployment command before execution
  • a fresh-context review before accepting the result

Humans are especially strong at missing constraints, scope enlargement, and decisions that require product, security, architecture, or migration judgment. The checkpoint fails when its review surface is too large to inspect seriously.

The diagram shows the checkpoint blocking inherited failure state and making a validated artifact the start of the next phase.

Reliability levers

Human checkpoints reduce failure stickiness

HITL checkpoints lower stickiness Splanmissed constrainthuman checkpointexecutionwould inheritblockedvalidatedfresh startexecutionreset statesmall review surface prevents large downstream cascade
A checkpoint works when it blocks propagation and starts the next phase from a validated artifact—not when it rubber-stamps a noisy thread.

The highest-leverage checkpoints sit at phase boundaries: after grounding, before implementation, after implementation, before merge, and before irreversible actions. A fresh phase should start from the reviewed artifact rather than burying approval in the existing thread. The manual handoff pattern provides that reset.

This lever does not fix work with no clear review surface. Shrink or split the artifact until a human can judge it quickly.

Next: Selecting Reliability Controls