HITL Block and Resume: Narrative-Plane Continuation and Control-Plane Blocking

From the Dongfang Yiteng execution agent (case by Bo Liang)

Definition

When an execution-type agent runs a business process on its own, there are a few positions where it should not be allowed to execute all the way through. Deleting a batch of data, issuing a payroll disbursement, filing a tax return — once one of these actions goes wrong, it cannot be rolled back. Human-in-the-loop (HITL) means stopping the execution flow at these critical positions, waiting for a person to review and confirm, and only then letting the agent continue all the way down. The hard part is not the stop, but how to fully restore the execution state once you have stopped.

How it works

This stop-and-resume mechanism comes in two forms, an order of magnitude apart in engineering complexity.

The first is narrative-plane continuation. At its core it still generates content from narrative context. The typical scenario is an AI coding IDE, where the agent has worked out a way to make changes but worries about breaking the existing logic, so it ends the current turn and asks you to confirm. In the next turn you type "continue" or "confirm," and it reads the full narrative context in the session and finishes the code change. This form is easy to implement, because all you need is to end the current turn and let the user start a fresh natural-language turn next time; everything needed to resume sits in the narrative state.

The second is control-plane blocking, which is far more complex to engineer. The agent is about to run a script or command in the local terminal; instead of ending the current turn, it blocks the current execution flow and pops up a panel asking whether to Accept. You click Accept, and the execution flow resumes from exactly the point where it was blocked. This form cannot be substituted with "start a fresh turn": it has to preserve the execution state at the interruption point in memory, and it also has to manage what state the task graph as a whole and each of its downstream nodes are in when one planning pass produces multiple tasks and one of them gets blocked. Implementing this mechanism from scratch requires a whole task-state model designed for the purpose.

In Dongfang Yiteng's architecture, control-plane blocking is cheap to implement. The reason is that, at an earlier stage, to solve ReAct's cross-step and skipped-step problem, the team had already landed the plan-and-execute pattern — to make a multi-step task run in the right order under strict dependencies, the team built a task DAG, a task state machine, a scheduler, and an executor. A task node can be scheduled to start only when all of its upstream dependencies are completed and the node itself is ready, and the whole scheduling process is driven by this state machine. With this state machine already in place, blocking and human-reviewed continuation at critical tasks or critical tool calls take almost no extra construction: blocking is making a node halt in a waiting-for-approval state, and resuming is letting it re-enter ready once approval goes through. Which critical tasks and which tool calls need to be hung for human review can also be maintained with declarative configuration, without writing separate code for each sensitive operation.

What it guards against is the kind of accident an execution-type agent can least afford: leaving irreversible business operations to run automatically. In Dongfang Yiteng's setting, once actions like initiating a payroll disbursement or filing and paying a return go wrong, they either corrupt business data or produce a false success — the agent's execution "succeeds" while the actual business state is not achieved or is left damaged. Setting these actions as critical nodes and forcing human review keeps a point of human intervention between automation and irreversible risk.

When you need it

When your agent will automatically execute irreversible, sensitive, or high-risk business operations, and those operations must go through human confirmation. For control-plane blocking to land cheaply, the precondition is that you already have a task DAG and state machine; the execution state that must be preserved during the block belongs to the separation of powers in the unified session state plane.

This is an ADPS blue-book concept. Back to Concepts or the pattern matrix.