Human-in-the-Loop Is a Checkpoint. Out-of-Band Is a Trust Boundary.
HITL frameworks decide where the agent pauses. They do not supply an approval channel with an independent trust root. An approval collected in-band, inside the same session, UI, and process the agent controls, inherits that channel's compromise.
What HITL guidance gets right
The frameworks converged on the right questions. Which agent actions are reversible and which are not. Where the risk tiers sit. Where the workflow pauses for a person. Checkpoint placement is a solved design conversation, and teams implementing agentic systems mostly have it right.
The in-band approval problem
Then the workflow pauses, and the unsolved question appears: pauses into what? The common answer is a confirmation inside the same surface the agent runs on. A prompt rendered by the orchestrator. A button in the orchestrator's UI. A log written by the orchestrator.
Run the trust-boundary analysis on that loop and it collapses to one sentence: a single trust domain attesting to itself. If the agent is prompt-injected, the injected content writes the approval prompt. If the session is hijacked, the hijacker clicks the button. If the orchestrator is compromised, the log says whatever the compromise needs it to say. An in-band approval inherits the compromise of the channel it rides.
Out-of-band approval, defined precisely
An approval channel is out-of-band when it has an independent trust root. Concretely, four properties. The approval is produced on a separately enrolled device, so the agent runtime never touches the surface where consent happens. It is gated by a fresh biometric, so a person is present. It is signed by a hardware-bound key, so the artifact cannot be minted by software. It is verified server-side against the exact action parameters, so the approval covers this action and no other. The agent can request. It cannot approve, forge the approval, or render the screen the approval happens on.
Consent liveness
Most in-band designs also miss time. Consent must prove presence now. A standing grant, a cached confirmation, a remembered "yes" from an earlier session: each is a token, and tokens are what agents carry. A fresh biometric press at the moment of the action is evidence. The difference is exactly the difference between delegation and approval, and disputes turn on it.
What this does and does not fix
Orchestration and HITL frameworks keep what they own: routing, policy, risk tiers, checkpoint placement. Out-of-band approval supplies the one thing they structurally cannot: the channel. It does not fix HITL design, agent alignment, or policy quality. A well-placed checkpoint with a weak channel fails at the channel. A strong channel behind a badly placed checkpoint approves the wrong things confidently. You need both, and they are different problems.
Common questions
Why isn't a confirmation dialog in the agent UI enough?
Because it is one trust domain attesting to itself. The surface that renders the dialog, collects the click, and writes the log is the surface under attack.
What makes an approval channel out-of-band?
Separate device, separate key, separate verification path: produced on separately enrolled hardware, gated by a fresh biometric, signed by a hardware-bound key, verified server-side against the action parameters.
Does this replace our HITL framework?
No. It is the approval channel inside it. Your framework decides where to pause; this supplies what the pause lands on.