📖 Lecture — Pausing for Permission: HITL, A2A, and AGENTS.md

Every agent you've built so far runs start to finish without stopping to ask permission. That works fine for read-only tasks — searching, summarizing, drafting. It stops working the moment your agent can do something consequential: deploy code, charge a card, send an email to a customer, delete a record. At that point, autonomy without a checkpoint is a liability, not a feature. This week is about building the checkpoint, and about two emerging standards — A2A and AGENTS.md — that are shaping how agents talk to other agents and to the humans (and tools) around them. Human-in-the-loop (HITL) is a design pattern, not a fallback. A well-designed agent system pauses deliberately at points where a human can add context the agent doesn't have — a policy that changed last week, an edge case nobody documented, a customer relationship that matters more than the ticket says. The Agent2Agent (A2A) protocol actually bakes this into its task lifecycle. Every A2A task moves through states, and some of those states are interrupted states rather than terminal ones:

That distinction matters: a task sitting in INPUT_REQUIRED isn't broken or stalled — it's doing exactly what it should, waiting for a person to weigh in before continuing. Implementing the pause: interrupt() and Command. In LangGraph, you don't need to hand-roll a polling loop or a database flag to pause an agent. You call interrupt() inside a node or tool right before the sensitive step. This halts graph execution and returns a payload — typically the proposed action — out to whatever is hosting the agent (a CLI, a web app, a Slack bot). A human reviews that payload and can approve, reject, or edit it. Execution resumes when your application calls the graph again with a Command(resume=...) object carrying the human's decision. LangGraph's checkpointing system persists the graph's state automatically across that pause, so the interruption can last seconds or days — the agent doesn't lose its place. The best-practice pattern looks like this: the agent drafts a plan (e.g., "deploy this build to production" or "charge \$420 to card ending 4471"), calls interrupt() to expose that plan for edit/approve/reject, and only proceeds via Command(resume=...) once a human has signed off. Reserve this for irreversible or high-blast-radius actions — writes, spend, deploys, deletions, anything hard to undo. Read-only steps (searching, summarizing, drafting a first pass) generally don't need it. A2A: agents talking to agents. Announced by Google in April 2025, released under Apache 2.0, and donated to the Linux Foundation in June 2025, A2A solves a different problem than MCP. Where MCP connects one agent to its tools and context (agent-to-tool), A2A lets independent agents find and delegate to each other (agent-to-agent). An A2A-compliant agent publishes an Agent Card — a JSON document at a well-known path, /.well-known/agent-card.json — that advertises its name, endpoint, capabilities/skills, and authentication requirements. Another agent (or a "concierge" orchestrator) fetches that card, learns what the remote agent can do, and delegates work to it over JSON-RPC 2.0 over HTTP, with support for streaming responses via Server-Sent Events (SSE). AGENTS.md: a README for agents. Separately, a lightweight, schema-free Markdown convention called AGENTS.md has emerged as a way to tell coding agents how to work in a repository — build commands, test commands, style conventions, things a human contributor would learn from a README but that agents need spelled out explicitly. It's now stewarded by the Agentic AI Foundation, supported across 30+ tools (OpenAI Codex, Claude Code, GitHub Copilot, Cursor, Gemini CLI, Google Jules, Windsurf among them), and adopted by more than 60,000 projects. In a monorepo, tools read the nearest AGENTS.md file up the directory tree — the closest one wins, so a package can override root-level instructions with its own. Table: comparing the standards

Correcting three misconceptions. First: "Needing a human in the loop means the AI isn't good enough yet." Not so. HITL is deliberate. Perfect automation is neither possible nor desirable in domains where context outside the prompt — recent policy shifts, unwritten exceptions, relationship history — changes the right answer. The checkpoint is precisely where that outside context enters the system. A mature agent design includes HITL rather than treating it as a temporary crutch to be engineered away. Second: "The safest approach is to have a human approve every single agent action." This feels safe but backfires. Reviewing every output tanks throughput — you've just rebuilt the slow manual process you were trying to improve — and worse, it induces automation complacency: reviewers facing a wall of routine approvals start rubber-stamping, and the one dangerous action slips through with the rest. The fix is to route approvals by risk level. Low-risk, reversible actions run autonomously; high-blast-radius, irreversible ones stop for review. Risk-based routing keeps human attention scarce and pointed at what actually needs it. Third: "A2A and MCP are competing standards that do the same thing." They're not. MCP is agent-to-tool: it gives one agent structured access to data sources, functions, and context. A2A is agent-to-agent: it handles discovery and task delegation between separate agents, potentially built by different teams or vendors. Production systems increasingly use both — an agent might use MCP to query its own tools while using A2A to hand off a sub-task to a specialist agent elsewhere.