There’s an agent design pattern with an uncomfortable premise: the agent is the orchestrator, and you are one of its tools.

It goes by a few names — human-as-a-tool, human-as-tool, sometimes lumped under “human-in-the-loop.” But it’s worth separating the two, because the inversion is the whole point.

Human-in-the-loop vs. human-as-a-tool

Human-in-the-loop keeps the human in charge. The agent proposes, the human approves. You’re the supervisor signing off on the intern’s work before it ships. Control flow belongs to you.

Human-as-a-tool flips it. The agent owns the plan. It decomposes the task, executes what it can, and when it hits a step that only a human can perform, it calls the human — with the same interface it uses to call a search API or a shell. You get a message: “I need the 2FA code from your phone.” You answer. The agent continues.

In the first pattern, the human is management. In the second, the human is a blocking I/O call with unusually high latency.

What only humans can do (for now)

The pattern exists because there’s a residue of tasks that no tool call can cover:

  • Physical actions. Plug in the cable, reboot the router, sign the paper, go look at the machine that’s actually on fire.
  • Auth walls designed to stop machines. CAPTCHAs, 2FA codes, biometric checks, “click the link we sent to your phone.” These are, by construction, human-only.
  • Legal and social standing. Only a human can consent, sign a contract, or make the phone call where the bank insists on hearing a voice.
  • Judgment and taste. “Which of these three logos feels right?” is a question with no assertion to check. Someone has to just decide.
  • Access the agent doesn’t have. The password in your head, the context from a hallway conversation, the tribal knowledge that never made it into a doc.

Notice the parenthetical doing heavy lifting in this post’s premise: for now. That list is not stable. Ten years ago “read the text in this blurry image” was on it. Computer-use agents are eating the physical-clicking category as we speak. The list only shrinks.

The implementation is almost insultingly simple

At its core, the pattern is one tool definition:

{
  "name": "ask_human",
  "description": "Ask the human operator. Expensive and slow — use only when no other tool can answer.",
  "parameters": {
    "question": "What you need, with enough context to answer without reading your whole transcript"
  }
}

That’s it. LangChain has shipped it for years as HumanInputRun. Tools like HumanLayer wrap it in Slack approvals and async queues. Claude Code has AskUserQuestion. Every serious agent framework converges on the same shape, because the shape is obvious: a function call whose backend is a person.

The interesting engineering is in the details around it:

  • Make it expensive in the prompt. If the tool description doesn’t scream “last resort,” the agent will use you as a search engine. You become the bottleneck in your own automation.
  • Go async by default. A blocking prompt in a terminal is fine for a 5-minute task. For a long-running agent, the human call should be a notification — Slack, email, push — with the agent parked on that branch while it works on others.
  • Demand batching. An agent that interrupts you four times with one question each is worse than one that interrupts you once with four questions. This is worth stating explicitly in the system prompt.
  • Set timeouts and fallbacks. Humans are unreliable infrastructure. We sleep, we go to lunch, we ignore notifications. Decide what the agent does when the human call times out: retry, escalate, or degrade gracefully.
  • Log every call. The transcript of what the agent asked and what the human answered is your audit trail — and, later, your training data for automating that exact question away.

The uncomfortable part is the useful part

It’s easy to read this pattern as dystopian — the machine dispatching work orders to its human peripheral. I think the honest reading is more practical: it’s an inventory system.

Every ask_human call in your logs is a receipt for a task that resisted automation. Grep those logs after a month and you have something valuable: a ranked list of what actually requires you. Some entries are permanent (judgment, consent, taste). Most aren’t. “Fetch the 2FA code” disappears the day you wire up a TOTP secret. “Which environment is prod?” disappears the day you write it down.

That’s the discipline the pattern enforces, and it’s the same one I apply everywhere else: treat yourself as a dependency to be minimized, not a supervisor to be flattered. Design the human tool with a clean interface — a question in, an answer out — and swapping the human for software later becomes a one-line change. The agent never even notices you left.

Where this is heading

The endgame is visible from here. The human-as-a-tool call rate is the single most honest metric of agent autonomy — far more honest than any benchmark. An agent that calls ask_human twenty times per task is a form with extra steps. One that calls it zero times doesn’t need you.

The interesting number is in between, and it’s dropping. My advice: implement the pattern, log the calls, and watch which of your irreplaceable human contributions quietly fall off the list.

For now, the agent still needs someone to plug in the cable. Enjoy it while it lasts.