Mastering Human-in-the-Loop for Enterprise LLM Agents with LangGraph

Why Human-in-the-Loop matters for enterprise LLM agents

In high‑stakes enterprise scenarios LLM agents can hallucinate, make reasoning errors, or violate compliance, so human supervision is required to improve accuracy, trustworthiness, and user experience.

Common HITL patterns

Approval : a human reviews and approves or rejects a critical agent action.

Information injection : a human supplies missing data or corrects intermediate results.

Safety control : a human audits tool usage, especially for destructive tools.

LangGraph core mechanisms for HITL

Interrupt (pause execution)

An interrupt call suspends the workflow and returns a data object to the user. The node can later resume based on the human decision.

from langgraph.types import interrupt, Command

def human_review_node(state: State):
    # pause execution, send data for human review
    review_data = {
        "question": "请审核以下内容:",
        "output": state["llm_output"]
    }
    decision = interrupt(review_data)
    if decision == "approve":
        return Command(goto="approved_node")
    else:
        return Command(goto="rejected_node")

Command Resume (continue execution)

After the human provides feedback, the client calls

graph.invoke(Command(resume=user_decision), config={"thread_id": thread_id})

to feed the decision back and restart the workflow.

# invoke the workflow
result = graph.invoke(initial_state, config={"thread_id": thread_id})
interrupt_info = result["__interrupt__"][0].value
# simulate human feedback
user_decision = "approve"
result = graph.invoke(Command(resume=user_decision), config={"thread_id": thread_id})

Checkpoint (state persistence)

LangGraph can store the workflow state in a checkpoint manager (e.g., PostgreSQL) so that a paused workflow can be restored later or replayed after a failure.

with PostgresSaver.from_conn_string(
    "postgresql://postgres:yourpassword@localhost/postgres?sslmode=disable"
) as checkpointer:
    checkpointer.setup()
    graph = builder.compile(checkpointer=checkpointer)

Tool‑call control modes

Centralized guard mode

All tool calls pass through a single approval node. High‑risk tools trigger an interrupt asking the human to approve, reject, or edit the request.

def human_approval_node(state: State):
    # extract first tool call for demonstration
    tc = tool_calls[0]
    tool_name = tc.get("name", "未知工具")
    tool_args = tc.get("args", {})
    if tool_name not in HIGH_RISK_TOOLS:
        return {"human_approved": True}
    tool_calls_str = "
 - ".join([f"{tool_name}({tool_args})"])
    value = interrupt({
        "tool_calls": tool_calls_str,
        "message": "请输入 'ok' 批准工具使用，或输入 'reject' 拒绝"
    })
    ...

Self‑management mode

Each tool decides internally whether to request human approval. The tool raises an interrupt with a descriptive message; the workflow resumes based on the response.

async def tavily_search(query: str, search_depth: str = "basic"):
    response = interrupt({
        "tool": "tavily_search",
        "args": {"query": query, "search_depth": search_depth},
        "message": f"准备使用Tavily搜索：
- 查询: {query}
- 深度: {search_depth}
是否继续？"
    })
    if response["type"] == "accept":
        pass  # proceed with real search
    elif response["type"] == "edit":
        query = response["args"]["query"]
    else:
        return "该工具被拒绝使用，请尝试其他方法或拒绝回答问题。"
    ...  # actual tool logic

Decorator for easy HITL integration

A decorator can wrap any tool function to automatically add the interrupt‑based approval flow, avoiding repetitive code.

@human_in_the_loop()
def tavily_search(query: str, search_depth: str = "basic"):
    """使用Tavily进行网络搜索"""
    try:
        ...

Execution flow example

Client invokes the workflow with a unique thread_id and initial input.

The graph runs until it reaches a human‑review node and returns an interrupt payload.

The client presents the payload to the user and collects a decision.

The client calls

graph.invoke(Command(resume=decision), config={"thread_id": thread_id})

to continue.

If the decision is approved, the workflow proceeds; otherwise it may loop back or terminate.

Key considerations

Interrupt is an exception : do not catch it unintentionally, otherwise the pause will not work.

Resume starts from the interrupted node : state changes before the interrupt are not re‑executed.

Thread ID must be consistent for checkpoint lookup and resume operations.

Conclusion

By leveraging LangGraph’s interrupt, resume, and checkpoint mechanisms, developers can embed robust Human‑in‑the‑Loop controls into enterprise LLM agents, ensuring safe tool usage, auditability, and reliable error recovery.