Why Slack and Email Are Not a Human-in-the-Loop Strategy for AI Agents

The approval step most agent workflows skip

Agent orchestration frameworks have made it straightforward to insert an approval gate into an AI workflow: a line of code that pauses execution and waits for a decision before a tool call runs. The logic side of human-in-the-loop has matured quickly. The notification side has not kept pace.

In practice, teams wire the approval request into whatever channel is already integrated, typically Slack, email, or Microsoft Teams, because that is the fastest way to get a working prototype. It is rarely revisited once the agent moves into production, even as the agent starts taking actions with real financial, operational, or regulatory consequences.

The result is a governance gap hiding inside what looks like a governance feature. The workflow has an approval step. It just does not have a reliable way of getting that approval in front of the right person in time.

Why Slack and email fail as an escalation channel

Slack, email, and Teams were built for conversation, not accountable escalation. They are opt-in by design: a message sits in a channel or inbox until someone happens to look, with no guarantee that happens before the agent's timeout expires or a fallback rule kicks in.

This is not hypothetical. Popular approval SDKs for AI agents route requests through exactly these channels by default. One of the most widely used human-in-the-loop frameworks for AI agents ships with Slack, email, and Discord as its integrations, because they are the channels available out of the box, not because they are the most reliable way to reach a human under time pressure.

Three failure modes show up repeatedly once agents move from pilot to production: the notification arrives but is buried under unread messages, the notification arrives but the recipient is unavailable with no defined escalation, or the notification technically "sends" but nobody can later prove who saw it or when. Each defeats the purpose of having a human in the loop at all.

Presence is not proof

There is a meaningful difference between a human being theoretically able to see a decision and an organisation being able to demonstrate that a qualified person reviewed it. Regulatory frameworks are starting to draw that line explicitly. The EU AI Act legally requires demonstrable human oversight for high-risk systems, and NIST's AI Risk Management Framework, while voluntary, pushes organisations toward the same standard through its documentation and audit trail expectations.

Analysts expect this pressure to intensify simply because of scale. Agentic AI is projected to be embedded in around a third of enterprise software by 2028, up from under one percent in 2024, meaning the volume of approval decisions running through whatever notification channel an organisation has wired up is about to grow substantially. The same forecast expects more than 40% of agentic AI projects to be cancelled by the end of 2027, citing escalating costs, unclear business value, or inadequate risk controls as the leading causes. A notification layer nobody trusts to reach the right person in time is exactly the kind of inadequate risk control that shows up on that list.

An unread Slack message with a timestamp does not answer the question a regulator, an auditor, or an internal risk committee is likely to ask: who approved this, when, and how do you know they saw everything they needed to.

What a real human-in-the-loop layer needs

Treating the notification layer as a governance component rather than an integration afterthought changes what "good enough" looks like. At minimum, it needs:

• Guaranteed visibility: a delivery method that interrupts rather than waits to be noticed, the same principle behind an emergency alert system guaranteeing an employee sees a message immediately, so the request is not competing with unread channel messages.
• Identity-bound acknowledgement: a record of exactly who saw the request and confirmed a decision, not just that a message was delivered to an address or channel, closing the same acknowledgement gap that shows up in incident communications more broadly.
• A defined escalation path: if the primary approver does not respond within a set window, the request should automatically reach a backup, the same principle behind a documented incident response communication plan.
• An audit trail: a durable record that can be produced later, tying the decision back to a specific person, action, and timestamp.
• Programmatic integration: the approval or rejection needs to flow back into the agent's workflow automatically via an API, not require someone to manually update a ticket.

None of this requires replacing the orchestration layer teams already use. It requires treating the notification and acknowledgement step as seriously as the decision logic sitting either side of it.

What good looks like in practice

A workable pattern looks like this: an AI agent reaches a decision point and calls a webhook rather than posting to a channel. That webhook triggers a notification designed to be seen immediately, delivered to the approver's desktop rather than added to a queue of unread messages. The approver acknowledges or rejects the action, that decision is logged against their identity with a timestamp, and the result is returned to the agent programmatically so the workflow can continue without anyone needing to check back manually. If nobody responds in time, the request escalates automatically rather than stalling.

This is the model Heed's desktop alert and acknowledgement infrastructure was built for, originally for incident and safety communications, and it maps directly onto AI agent approval workflows: guaranteed-to-be-seen delivery, identity-bound acknowledgement, and an audit trail, triggered via API from whatever system needs a human decision.

The organisations that get agentic AI oversight right will be the ones that stop treating "notify a human" as a footnote in the workflow diagram and start treating it as infrastructure.