Secure “Human in the Loop” Interactions for AI Agents

Speaker 1 [00:07]

Hi everyone, thanks for coming today. So my name is Juan and yeah, so today we're gonna be talking about secure human in-the-loop interactions for AI agents So we'll explore what that is We'll also explore why it is important and we'll cover a little bit of how you can implement it But we're gonna keep it to the basics Before we start with the presentation you can also check me out on social medias with at at vhacmartinez, or you can scan that QR code that will take you to my website. And yeah, we can connect and continue the discussion about security in the AI space and other cool things online. But let's get started. But before we start exploring the topic of AI agents, I think it's important to start from the beginning, right? So to where everything started and what we are all familiar with, which is simple chatbots, right? In a way, we all have sometimes played a little bit with ChatGDP. We probably all have that experience with Cloud or with any other of the popular providers now. And it basically goes something like this, where you say hi to a chatbot, and then he replies, hey there. And now we take that as granted, but if you ask someone 10 years ago, this was kind of like magical. You can be able to talk to a computer, and it replies, and it sounds kind of like a human being. I mean, that is fantastic. And, yeah, so this is where we started, and if you think a little bit about how a chatbot works in this very sophisticated diagram that I created, you can see that we have this very fancy gentleman here that sends a message to the AI, and the AI sends back a response. It's pretty straightforward, very simple, there's no state management, the AI has no knowledge of what happened in the past, every time that we want to carry a conversation with the chatbot, we need to send them the whole message list so that it can re-evaluate all the messages and all the conversations that we had before so that it can reply with some context. So they are stateless entities. And they are cool, but a little bit boring. We use them all the time. We confess our darkest secrets to the AI, and we are cool with that. But sometimes we want a little bit more. Because stateless for chatbots is just simply not cool. It cannot do too many things. Because every time we want to do something with them, we need to remind them what we were talking about, and it's kind of tedious, and they forget. So we want some kind of state. And that's when AI agents come into piece. AI agents bring state into the AI world. And so they are stateful. They can remember goals. They can remember steps, where they are in the part of the thinking process. And they can do partial results, stop the execution, and come back later. So they are much more interesting. They are really, really, really cool to play with. And if you have ever used something like Cursor or Windsor to do this vibe coding thing everybody likes to do now. I was playing in a dance, but I was told not to move from the podium, so you'll miss on that. Sorry. But, yeah, so agents are a little bit more like humans, but they are also way harder to control. Kind of like humans, in a way. Otherwise, ask one of my kids, right? All right, so I made another very sophisticated here diagram of how an AI agent works. And we can see that there are a little bit more moving parts for an AI agent. First, we got rid of the human, right? Because that's the end goal, right? We are not helpful anymore in this world. AI will take over. But we still have some kind of input in this picture, right? But the input doesn't necessarily need to be a human. It can be another system. It can be another agent. And this is an important distinction that we need to make. So we have some input that's going to go into the AI agent, and the AI agent goes some kind of planning phase. This is where it's thinking, right? And now we like to call it thinking or reasoning or planning, creating that plan for execution. And then it has some tools at its disposal, right? So it can interact with tools, and we can use these tools to gather context from other applications, from third parties, from things that are stored in your computer, right? So tools is what makes AI agents a lot more interesting because now it's not just interacting with a model that knows nothing about us, that knows nothing about our environment. Now we can start getting all these environment context and now we can also start introducing change because so far we were able to talk to it, but we weren't able to do anything with it. But now tools allow us to call third-party APIs, allow us to call the file system, allow us to modify files. So it gets a lot more interesting. And finally, it produces an output. And AI agents are, like, fascinating, right? So they are really, really good. And let's explore an example of what you can do potentially with an AI agent like the one we saw before. Again, we have this kind of like chatbot AI agent now where we say, hey, AI, I want to go to the beach to relax and enjoy the water, right? A very simple prompt, and the AI responds, sure, I'll book you a trip. And then the AI goes into the background world where it's processing all the data and churning and coming up with an ideal trip for us, with an ideal destination, looking for the best prices because it has access to everything that it needs to know about in the internet, it has all the tools that it needs at its disposal, and eventually will come back to us with a proposal, or perhaps it even does the booking for us, and while we are packing all our summer clothes, and we are getting ready with our sand toys, and we go and we pack on a plane, and we go to the destination the AI selected for us, and And I mean, that's a really cool-looking dude, certainly that's something I would wear to the beach, but he's not happy because what went wrong with our plans, right? Everything was going well, they executed, he booked everything for us, and he's not happy. He's not happy even though he got everything he prompted for. He has there his very German-looking sandals, he has his sand toys, he has the water he wanted to, maybe a little bit too much, right? But yes, we can feel that something even though technically correct is not what we were hoping for when we designed that prompt, right? So we were not very smart when we tell the AI what to do, but the AI also wasn't very smart in confirming anything that we wanted to do or even confirming before we did any booking or any sorts, right? So we delegated to the AI, the AI acted autonomously, but without the right context, without any oversight at all, and it produced terrible results, right? And that's kind of like a funny scenario where we just went to the beach, but imagine a world where AI controls a lot more important things, like where it has access to your banking account, where it makes purchasing decisions for you, where it influences the stock market, or things where the stakes are high, like in medicine or things like that, where they are making decisions for us, we don't really want an AI to make decisions for us, right? Or hopefully not, because we see kind of like what will happen. What we want is we want AI to augment our abilities, but not to replace our judgment. So we as humans, we have a lot of history, we have a lot of understanding of how the world works, we know what we want. We are the ultimate decision makers, and we don't want to delegate that to any AI system. We want to be the ones that have the final say in it. I think that's a pretty good remark that I came up totally on my own, and I felt like I had my own Iron Man moment, so, yeah, it's cool. All right. So with great power comes great responsibility. I couldn't create all the lines in this slide, sorry. I had to steal a few, but we had Spidey there to keep us in check. So human oversight is the key to wielding the AI's immense powers and responsibilities, and that's what we want to enter into this AI world, right? So let's go back a little bit to our AI agent, where we started, with this picture where we have our input, where we have our planning, where we have the tools for execution, and output. What do you think is missing here in this picture? What we're removing the first time, right? We remove the humans, and the humans are what makes things matter. So we need to bring the humans back in the picture. So we could put the humans in the output, for example, and that's kind of like what we got. Not an ideal scenario. We could put the humans in the planning, but then again why do we need an AI then, right? If the humans are doing the whole thing. So we want to keep the humans in the input and we want to keep the humans somewhere between the planning and the output. And so we can add the human there, for example. So there we have a very reasonable human being. Now when we have the input and the input can be coming from the same human right the input can be I still want to go on holidays to the beach and I want to see water right and and now goes through the AI goes through the planning phase and it starts thinking about all the different possibilities it comes up with a few suggestions right so these are the options that you have places where you can go on these times of the year and then the human can take a look into that and say, like, okay, November in Ireland, maybe not a great idea. August in Germany, yeah, maybe that could work out, right? So the human can use the experience and the knowledge that it has, or it can Google it. Hopefully it doesn't ask the same AI for exactly the same input, but it has the opportunity now to double-check the work of the agent before it goes and executes, before it goes and does the tool calling to book the trip or to continue with anything that it needs to be done to produce the output. And this is very important, especially at this stage of AI, because the way AI is working today is not the AI that we all think it is, right? It's not still general artificial intelligence. It is pretty good, and it is getting better, but it's still producing mediocre results when the inputs are not correct or in situations that the AI doesn't know. We still have a lot of hallucinations, Hopefully it doesn't even send us to a trip to a place it doesn't exist, right? So at least maybe it can validate that. But there are still a lot of risks. And until we have AGI and we just can relax and watch TV all day because there's nothing less for us to do, we need the humans in this equation. And we need the humans in the picture because we are the drivers. We are in the seat. And this is what we call human in the loop, right? So now the human is not anymore the main protagonist. It's not the one that creates the story and plans and does everything. No, he's just someone in the loop. Someone who's been notified, kind of like a manager for the AI, right? Can I take holidays? Yes. No, no, you can't. And we call that human in the loop in the industry. And this is where the human has oversight at decision points. And here are some examples, right? So there are different types of human oversights. There's review before action, kind of like what we did before where we need to approve to book a trip or not. And that's very basic. It's kind of like a Boolean thing, right? So it's continue or pause, whatever it is that you are doing in AI. We can also collect human input. Like, for example, in the case before, if the AI would have told us, hey, what do you mean by you want a lot of water? Do you want it to be rainy or you just want to swim in the water, right? Like, if you would have asked us a few more questions, We could have provided answers, and that would have produced better results. So that's the second type of interventions. And then the third one is to manually edit the agent state. And this one is a little bit lesser known. But remember, when you are working with these agents at the part of planning and tool calling in each one of these steps, a state was saved. Like, for example, where was planning to go to the possible destination. Maybe there was a variable with the price. Maybe there was a variable with the airline. There were all these different variables. And now the human can go in there and correct on the state so that when it continues the workflow execution, it continues with the right set of data. And I mean, this will be something fantastic. But this is not really a novel idea. Can anyone think of any scenarios where we already have this in production and we don't even think about it. So one for me, or one of the first ones that came to my mind was when I'm driving. So when I'm driving, now newer model cars will try to correct you to stay in the lanes. Sometimes they will start braking in advance when they see a car coming very close or things like that. But the car stops all its autonomous functions the moment you press on the pedal or the brake or the moment you steer to adjust, right? So my car always tries to correct me to stay in the lane, but sometimes it's not correct. So I steer a little bit back, it fights me for a second, and then it gives up, right? It automatically says, no, the human has to be right because he's the one in control, and let us continue. And this is exactly what we want when we talk about AI. We wanna be the drivers. We wanna be the ultimate decision makers. We don't want to be just the ones that consume the output if it hasn't been checked. Because it's our lives. It's our stake, what is at stake here. So let's understand a little bit how human in the loop workflows work. So when you have an AI agent, it goes through this planning phase. So it executes it maybe perhaps in multiple steps. Perhaps it thinks for a little bit, it comes up with some ideas, then it goes thinking again to validate those ideas, then it discards them. Like if anyone has been using Courser or something like that, the first thing it does, it tries random code. Then it runs some tests, it doesn't work, okay, types are wrong. Then it tries to fix the types. Then something else breaks. And then it tries... And so it has all of these different iterations, and in any of these iterations, it can trigger a pause. I put pause here in quotes because this is a term that is not standard across different AI agent frameworks. Like for example, if you're using something like line chain, this is called an interrupt, where the workflow basically pauses. It saves state as it currently is, and it delegates the workflow execution back to the prompt. So after we have a pause or an interrupt in the process, Then we have human reviewers that will receive all the necessary context. So everything that was in state, everything that has been planned in the AI, any piece of information that is relevant for the human issue received all that context. We talk about that a state is preserved during the review process. So if you're using something like Langchain, it will save the state somewhere. Either it's going to be in memory, and wait for the user to interact. Maybe not an ideal scenario for production, but it's most commonly known that it will try to save into a database like Redis, where it will persist that information to come back to it at a later point. So after the user reviews the feedback and is incorporated into the system, the workflow continues its execution from where it left. So it doesn't need to do all the previous steps again, because the state is a reflection of what happened before. It can continue from where it left off. And yeah, so those are kind of like the steps of human in the loop workflows. And now we can see it a little bit in action. I think I recorded this demo a little bit too fast. So if I don't catch up with the speed of the video, I'll go a little bit behind. Otherwise, I'll speak too fast. And I already speak way too fast. So let's go. So here we have a chatbot where we ask the chatbot to watch the stock market, and if there's a good opportunity to buy some stock, it will automatically buy it for us. So the chatbot says, like, hold on, I'm not authorized to send you push notifications, so it asks me for authorization, and then I go home, and at some point during the market, I receive a push notification, I check that notification that went too fast but the notifications basically had the question I found this opportunity in the market this is what am I about to buy I'm about to buy 10 stocks of Seco I think it was for $15 and then it asked me do you want to continue do you want to approve this request or do you want to reject it and the moment I click on approve this request the AI agent continues the task does the purchase for me and hopefully in 10 years I can retire, right? Because Zico is a great company. Probably working on human-on-the-loop solutions. But it is a developer conference after all, so we want to see a little bit of code. Unfortunately, I don't have a lot of time to go into all the details and nuggets about how human-in-the-loop interactions work, but this will give you a little bit of a picture of how it is implemented in one of the popular AI agent frameworks called LanChain, or LanGraph, or LanSmith. I don't know. They have multiple names for similar things. But at the beginning, we define a tool. And for example, that could be the risky action tool. And inside that tool, we simply raise an interrupt exception. Sometimes this is also defined as an interrupt function within LanChain, depending on the version that you are and how you plan to do things. But we basically trigger and interrupt where that says, for example, in this case, human review required. That's the context that we are giving the human about this interruption. That's everything that is happening. Then we define the agent executor from all the tools. And we pass an array of tools. In this case, we only have the risky action tool. And finally, we invoke the executor. And we pass the prompt, perform risky action. So we make sure it triggers. No matter what LLM you use, I think this is pretty straightforward, it should trigger that tool. And what is going to happen here is when the LLM starts evaluating the tool call, and it detects that the tool call is required, and it detects the interrupt, it will automatically save state at that point, and it will raise an exception. And the exception will be cached below there. And then it will, in this case, it's just printing the interruption into the command line, right? But you can see, like, in this case, you could, instead of that print, you could use this push notification and fancy system to collect information about the user and then continue the workflow, right? Again, each framework does things differently. Even the same framework will change its minds every two, three months. So you always need to be reading the latest documentation because things are always breaking at this point. This is EA life, right? We like vibing, we like breaking. So the interrupt pattern is not baked into every single framework. Sometimes you need to do it on your own. If you're on JavaScript, somewhere here. And you use Versailles AI. I'm sorry, but you have to do this on your own. If you're on Python using LanChain, kudos to you. You have all that integrated. And whoa, that's hard, right? Because interrupts were easy. But what about all this notification and fancy things? And how do I put everything back in the workflow? Yeah, that's a lot of code that you will have to write, Unfortunately, there's no other solution that I can think of that will quite solve that, unless you are familiar with Auth4GenAI. Sorry for the black here. But I am a developer advocate for Auth0. And Auth4GenAI kind of solves this problem. So we cover four different pillars for security for AI agents, for authentication and authorization for AI agents. from user authentication, Token Vault, asynchronous authorization, which is human-in-the-loop interruptions, and FGA for RAG. And if you want to learn more about this, I'm going to be these three days in front of the SAIS planetarium, I think it is, on E1. So you can come here and visit me, and we can discuss more, and we can see a little bit more code, a little bit more action on how everything works, because now time is almost up. You can scan the QR code there on the bottom right left of the screen. I feel like when I'm live streaming, I never know what is right, what is left. You can scan that QR code over there, and it will take you to the Auth0 website, where you can learn more about each one of these components. And with that said, I want to thank everybody for your time today and for joining. Again, let's connect. Let's start the discussion. Let's keep AI under control, and let's keep AI secure. Thank you.

Speaker 2 [22:29]

Thank you everyone and if you have any questions feel free to post it in Slido. So there are QR codes posted across the room, you can scan that and they can post your question.

Speaker 1 [22:49]

I guess I confused everybody, or I was very clear. Very clear, I would say. First question is very simple. Yeah? Which framework are you using now at the moment? Blockchain or 2PA? So I'm particularly fond of blockchain because it's kind of like the easier one for some of these situations. I'm not saying it's the best one, But it's also what I'm familiar with the most. And things are changing so fast that it's very hard to keep up with what everybody's doing. So I kind of picked one and went deep into one. If you follow, for example, what we are doing with Auth0, for Python, we are working with Lama index. And we are working with longchain directly. Because those seem to be the two most popular in the industry right now. But we are always listening to developers, Like, what are you all using, right? So we can also try and experiment new things. I'm always trying things, but it's very, very hard to keep up with all the details. So I'm really focused on longchain, because it serves my purpose in all the things that I have built.

Speaker 2 [24:02]

So we have a couple of questions come up here. So first of all, thank you for the good input How do you combine human in the loop and lang graph? How do you combine human in the loop and the lang graph

Speaker 1 [24:18]

How do you come in?

Speaker 2 [24:20]

that's the question okay

Speaker 1 [24:22]

So, I mean, LandGraph has very good documentation for human in the loop, and I really recommend that you go and check that documentation because it really provides a lot of details on how to trigger interrupts, which is this phenomenon that saves state and stops the workflow execution. After that, what you do with interrupt is really up to the developers, and this is something where I really feel like there's a lot of documentation missing because a lot of people now understand, okay, so I need to treat and interrupt, but what do I do after it, right? And there's a lot of discussions and there's a lot of conversations that are going on because no one has it very clear what is the best approach. How do we continue after that, right? And everybody will have, like, different opinions and it will be, like, in different ways. And I think it would take some time until some of these things settle and standardize on what are the best approaches. But for now, it's like, there's a lot of improvisation in some of these things.

Speaker 2 [25:25]

okay thank you the next question is what belongs to the state is it basically the messages from the chart so far

Speaker 1 [25:34]

So that will depend on your agent right so the messages are definitely always part of star of state But there could be a lot more things you could carry things like for example that we talked about in the case of the booking For the holiday trip you can have the destination as a variable state you can have the price as a variable state, right? So it will really be up to like your use case, but there's a lot of things you can carry state

Speaker 2 [25:57]

okay one last question we have can we use a second agent to verify the response of the first agent

Speaker 1 [26:05]

Can use the yes, yes, you can you may end up in a loop right because Ai is a little bit unpredictable and you may end up contradicting But if you take a look to some things like there are examples even like if you take a look cursor cursor kind of like That's something like that They have like this agent that write things and then there's the other that validates and sometimes you see that it tries one thing and then It validates and they doesn't like it and then it tries again and it goes for like five minutes it's fighting on what is the best solution until it gives up so that's kind of like what you get when you try something like that as I think it's missing the point I think the point is we want people to be the ultimate decision callers

Speaker 2 [26:46]

Great. With that, we are out of questions. Thank you so much once again, Jesse Martins, for your wonderful thoughts. Thank you everyone for participating. Once again, please give him a big round of applause for sharing his thoughts.