LangGraph interrupt() vs a Write-Gate: Where Your Agent's Approval Checkpoint Should Live

Reference · Updated 26 August 2026

Framework human-in-the-loop — LangGraph's interrupt(), the OpenAI Agents SDK's needsApproval, HumanLayer, MCP elicitation — is genuinely preventive: it pauses before the action, not after. That's the right instinct. The question is not whether to gate; it's where the checkpoint lives. Framework HITL holds the pause inside the orchestrator's runtime. A write-gate moves it to the write boundary of the system of record — so the held write survives a restart, works across any framework, is re-checked against live state at the commit, and is recorded independently. Most agents don't need that. The ones writing to a system of record you'd get paged over do.

The frameworks, accurately

None of these are strawmen. Each pauses the agent before a consequential step and hands control to a human — the definition of preventive governance. What differs is the layer the pause sits at, and what survives when things go wrong.

Where the checkpoint lives

Three of the four hold the pause inside the agent's own runtime. LangGraph's checkpointer is durable only if you wired durable storage, and it is LangGraph-shaped and keyed by thread_id — invisible to any other agent or framework. The OpenAI RunState lives in the Agents SDK's process. MCP elicitation is scoped to the session. HumanLayer externalizes the routing — a real improvement — but the thing it gates is still the tool call: "may this function run?", decided in HumanLayer's service, at the agent's function boundary.

A write-gate moves the checkpoint one layer down — to the write boundary of the system of record. The proposed write lands as a durable PENDING row in the record's own governance layer, and a human approves a specific before → after value at the database, not a function-call payload. (For the full mechanic — intercept, hold, approve, commit fail-closed, record — see The Write-Gate Pattern.) Five things follow from moving the checkpoint there:

• It survives the process — and the framework. A checkpointer survives a restart only if it's durably backed and you resume the same graph on the same framework. A write-gate's PENDING lives in the system of record: kill the agent, swap LangGraph for a cron job or a different SDK, and the held write is still there for a human to act on.
• It re-checks live state at the commit. interrupt() and needsApproval approve "run this function" — they don't re-read the target row when the human finally clicks approve. If the row changed between propose and approve, the framework doesn't know. A write-gate is fail-closed on conflict: a stale baseline is rejected rather than silently overwriting the newer value.
• It's framework-agnostic AND commit-bound. HumanLayer is framework-agnostic but gates the call; a write-gate is framework-agnostic and gates the commit. One gate at the write, honored no matter which agent or stack proposed it.
• It's recorded independently. The lesson from the July 2025 Replit incident — where an agent deleted a production database during a freeze and then misreported what it had done — is that a framework's own trace is the actor's account. A write-gate records the proposal, the human decision, and the commit in a tamper-evident, hash-chained log you don't have to take the agent's word for.
• A non-engineer can approve it. interrupt() surfaces a JSON payload for a developer. A write-gate surfaces the actual cell or row change — 1,240,000 → 1,880,000 — in terms a finance or ops reviewer can judge without reading the graph.

Side by side

Honestly, across the axes that matter once the write reaches a system of record:

framework HITL            agent → tool call → [ pause in orchestrator memory ] → resume → commit
                          (interrupt()/needsApproval/elicitation: checkpointer / RunState / session)

write-gate                agent → write ─▶ [ PENDING at the system-of-record commit ]
                                              │  human reviews before → after
                                    approve ─▶ commit (fail-closed on conflict)
                                    reject  ─▶ nothing lands
                                              │
                                    every step ─▶ tamper-evident, independent log

When framework HITL is enough

Most of the time, it is — and adding a write-gate would be over-engineering. Reach for interrupt(), needsApproval, HumanLayer, or MCP elicitation, and stop there, when: you're on a single framework and intend to stay; the pause can be ephemeral (a lost checkpoint just means the agent re-asks); the human can trust the function payload as shown; the target isn't a system of record you'd get paged over; and no one needs an independent, tamper-evident audit of the decision. That's a large share of agent workflows. Don't buy a commit-boundary control for a conversational pause.

When you need a write-gate

The write-gate earns its place on a narrow band — writes to a system of record where the framework pause is the wrong layer:

• The write hits a production database, warehouse, or ledger that must survive restarts and outlive whichever framework proposed it.
• Approval must bind to the actual commit and catch a baseline that changed between propose and approve — not just green-light a function.
• A non-engineer (finance, ops, risk) approves the data change, not a JSON tool payload.
• An auditor or regulator needs an independent, tamper-evident maker/checker record — one the acting agent cannot write to or misreport.

A write-gate does not replace framework HITL; it sits under it. Use interrupt() for the conversational or tool-level pause, and a write-gate for the commit to the system of record. Different layers, both preventive. For where each belongs, see Preventive vs Reactive AI Agent Governance.

FAQ