The Interrupt Primitive: How AI Agents Should Escalate to Humans

The autonomy paradox

The value proposition of AI agents is autonomy. They run continuously, they don't need hand-holding, they handle the routine so humans can handle the exceptional. That's the promise — and it's real. But autonomy without escalation is not just a governance problem. It's an operational risk.

Every AI agent will eventually encounter a situation it wasn't designed for: an input outside its training distribution, a decision with consequences too large for its authority level, a conflict between two valid instructions, or a factual premise it's uncertain about. In those moments, an agent without an escalation primitive has only bad options: guess and proceed, or silently fail.

The interrupt primitive gives agents a third option: stop, surface the decision, and wait for a human to choose before continuing. It's the difference between an agent that fails gracefully and one that fails silently.

How most teams handle escalation today — and why it fails

Without a structured interrupt primitive, enterprise teams handle agent escalation in ad hoc ways that create fragility:

• Email or Slack notifications: The agent sends a message and... stops. Or continues without waiting. The human sees the message hours later. No structured response mechanism, no audit trail of what was decided.
• Hardcoded confidence thresholds: If confidence < 0.7, don't act. This prevents some false positives, but it's a blunt instrument that doesn't explain why the agent stopped, or let a human provide the missing context to continue.
• Human approval queue in a spreadsheet: An agent writes to a "pending approval" spreadsheet. A human reviews it. The approved decisions are manually fed back. No API, no audit trail, no real-time resolution.

All of these approaches share the same failure mode: they create a break in the agent's operational continuity, with no structured mechanism for resuming — and no governance record of what happened at the break point.

The interrupt primitive: an API contract for human-in-the-loop

The interrupt primitive in Agent OS is a two-event protocol:

This is the complete human-in-the-loop cycle — and it creates a complete governance record. Every INTERRUPT + OVERRIDE pair is a decision audit record: what the agent was uncertain about, what the human decided, and when.

The implementation: six lines of agent code

Emitting an interrupt from an agent that's reached an authority boundary:

// Agent encounters a decision above its authority threshold
const { emitEvent } = require('./protocol.js');

async function handleUncertainDecision(context) {
  // Fire the interrupt — agent pauses here
  emitEvent('INTERRUPT_EVENT', 'my-agent', {
    question: `Contract value is $${context.value.toLocaleString()}. Approve for auto-execution?`,
    options: [
      'Approve — proceed with execution',
      'Hold — route to legal review',
      'Reject — decline and notify client'
    ],
    urgency: context.value > 500000 ? 'high' : 'medium',
    task_id: context.contract_id
  });

  // Poll for human resolution (10s intervals, 10min timeout)
  const decision = await pollForOverride(context.interruptEventId);

  // Resume with human's choice
  return executeWithDecision(context, decision.selected_option);
}

The guest resolution flow: no login required

One of the most important design decisions in the interrupt primitive is making human resolution frictionless. In a live client meeting or a time-sensitive production incident, requiring the human approver to log into a platform adds seconds of friction that compound into minutes of hesitation.

Agent OS generates a one-time guest resolution URL for every interrupt event. The agent (or the operator triggering the demo) can share this URL via Slack, email, or SMS. The recipient opens it in any browser, sees the interrupt question and options with full context, taps their choice, and the OVERRIDE_EVENT is written immediately.

No login. No account. No app to install. The resolution happens in the browser, the audit trail records who shared the link, and the agent resumes within seconds of the human making their choice.

Authority levels: designing the escalation boundary

The interrupt primitive is only as good as the authority design behind it. Agents that interrupt too rarely are dangerous — they're making decisions they shouldn't be making autonomously. Agents that interrupt too frequently are useless — they become a human rubber-stamping machine that adds latency without adding value.

Designing the right escalation boundary requires answering three questions:

1. What is the reversibility of this action? Sending a notification: highly reversible. Deleting a record: irreversible. Financial transactions above threshold: irreversible and consequential. The less reversible, the more interrupt-worthy.
2. What is the blast radius if the agent is wrong? Miscategorising a support ticket: low blast radius. Incorrectly approving a contract: high blast radius. High blast radius decisions should interrupt.
3. Does the agent have sufficient context to decide correctly? If the agent is uncertain — about facts, about intent, about consequences — an interrupt is the right call, regardless of the action's reversibility.

In practice, most teams define authority boundaries as explicit rules: interrupt if contract value > $X, interrupt if confidence < threshold, interrupt if action type is in the restricted set. Agent OS's automation rules engine lets you codify these boundaries and enforce them automatically across every agent in your org.

The audit record: why OVERRIDE_EVENT matters

The OVERRIDE_EVENT is not just a signal for the agent to resume. It's an enterprise governance artifact. Every resolved interrupt creates a record that answers:

• What decision was made?
• Who made it?
• When did they make it?
• What were the options presented?
• How long did human review take (time-to-resolve)?
• Was this decision part of a larger task or workflow?

For regulated industries, this is the difference between "we have human oversight of AI decisions" (a claim) and "here is the timestamped audit record of human oversight of AI decisions, exportable as CSV, filterable by agent, date range, and urgency level" (evidence).

Multi-agent interrupts: when one agent's decision affects another

In multi-agent systems, the interrupt primitive extends naturally to agent-to-agent escalation. An agent can emit an INTERRUPT_EVENT directed at another agent (rather than a human), representing a decision handoff. The receiving agent responds with an OVERRIDE_EVENT containing its resolution — and both events are logged in the audit trail, creating a visible chain of inter-agent delegation.

This is the foundation of auditable multi-agent coordination: not just knowing that agents worked together, but knowing exactly what each agent decided, what it deferred to another agent, and what the full decision chain looked like from end to end.

Putting it together

The interrupt primitive is not a feature. It's an architectural pattern — the pattern that makes AI agent autonomy safe to deploy at enterprise scale. Without it, your agents are either too conservative (doing nothing when uncertain) or too aggressive (doing things they shouldn't). With it, they have a structured, auditable, human-in-the-loop path for every decision that exceeds their authority.

The five-minute implementation is in the Agent OS quickstart. The governance architecture — audit trail, guest resolution, multi-agent escalation, automation rules — is ready to deploy the moment you add the first interrupt event to your agent code.