A good human in the loop for coding agents is more than a wall of "approve?" prompts. It is a system where the human only has to catch the mistakes they can realistically catch in time, and everything else is prevented by design. The way to build one is to grade each action the agent takes by how much damage it can do, then match the control to the grade: let trivial actions run, make low-risk edits notify-and-undoable, require a real review for risky merges, and outright prevent the high-stakes actions a human could never catch fast enough, like destructive shell commands, untrusted dependency installs, and production deploys. Approval prompts are for the narrow band where a human can actually see the problem and stop it. For the rest, prevention beats review.
This article walks through that build: the actions a typical coding agent takes, the grade each one earns, and the controls that fit. It rests on one question from the LoopRails framework. Can a human realistically catch this mistake in time? When the honest answer is no, you prevent the outcome instead of gating it behind a prompt nobody can meaningfully read.
Why approval prompts fail for coding agents
The reflex is to wrap a coding agent in confirmations: "ask me before you edit," "ask me before you run anything." It feels like oversight, but for most of what a coding agent does it is theater. Research on AI coding agents (see the LoopRails codex) found that requiring up-front plan approval did reduce attacks, yet when a human was given the chance to intervene mid-task, their success at actually catching and stopping the bad action stayed in the 9 to 26% range. People rubber-stamp. The harmful action looks like the helpful ones, scrolls past in a wall of diffs and shell output, and is often done the instant it fires.
