Two distinct questions
A human gate asks whether an exact action should happen. Idempotency asks what the system should do if the same action is requested again. A reviewer may approve one email, one issue creation, or one record update, yet a timeout may cause the workflow to retry after the service has already accepted it. Both questions need answers before the tool call. LangGraph documents interrupts that pause for human input and resume from saved state; the pause alone does not establish what happened in an outside service after execution continued.
Approve an immutable proposal
Present the destination, payload, expected effect, and operation identifier together. If the agent edits the payload after approval, invalidate that approval and request a new one. Save the approval decision with the proposal hash and the identity of the approving role, subject to the project's privacy rules. This is an editorial design recommendation rather than a feature claim about a particular framework. It gives a reviewer a specific object to assess and helps a later audit distinguish an authorized operation from a similar but unapproved one.
Make the write repeatable or reconcilable
Pass a stable idempotency key when the destination supports one. If it does not, query for a prior result using a durable operation identifier before retrying. Where even that is unavailable, stop and ask an operator to reconcile the outside state. Do not use a model's memory as the deduplication ledger. A checkpoint can preserve workflow state, but a crash may occur between the external write and the checkpoint. That gap is the reason the receiving system's receipt or an independent transaction record matters.
Exercise the ambiguous window
A useful dry run cuts the process immediately before a write, immediately after the service accepts it, and before confirmation is saved. The expected result is one authorized side effect or an explicit unresolved state, never a silent second effect. OWASP's agent guidance stresses human oversight and constrained tools, while LangGraph supplies a documented pause and resume mechanism. Neither eliminates distributed-systems ambiguity. Keep the interface honest: approved, attempted, confirmed, and unknown are different statuses. If confirmation is unknown, the safe next step is reconciliation, not an automatic victory message. Preserve the receipt as evidence.
What to carry into the work
- Bind approval to an exact payload and target.
- Assign a stable operation identifier.
- Use a receiver-supported idempotency key or reconciliation query.
- Simulate failure between write and confirmation.
Sources & dates
- Interrupts — LangGraph documentation ↗LangChain · Undated source · Checked 16 Sept 2026
- LLM Prompt Injection Prevention Cheat Sheet ↗OWASP · Undated source · Checked 16 Sept 2026
Unknown source dates stay undated. Preparation is not publication; no historical byline or interview is implied.