Designing Escalation Paths When an Agent Gets Stuck

An escalation path is a designed route from "the agent cannot safely proceed" to a human (or higher-privilege process) with enough context to finish the job.

Stuck means low confidence, conflicting evidence, repeated tool failure, policy ambiguity, or a required capability outside the current privilege ring.

Summary

Detect stuck states with host rules, stop guessing, package a concise escalation brief, route it to the right queue or person, pause or degrade gracefully, and resume only with a recorded human decision or handoff outcome.

Recipe

1. Define stuck signals: no-progress, low confidence, schema fail, policy conflict, missing data, auth errors.
2. Cap retries per signal; escalate instead of infinite polite loops.
3. Build an escalation brief: goal, attempts, evidence, question for the human, urgency.
4. Route by skill and risk (L1 support vs engineering vs compliance), not one mega-inbox.
5. Freeze side effects while waiting; keep the user informed with a clear status.
6. Accept structured human replies: answer, approve tool, reassign, or abort.
7. Resume the agent with the human input as a trusted observation labeled as human, or transfer ownership fully.
8. Measure time-to-escalate, time-to-resolve, and reopen rate; tune thresholds.

Working Example

from dataclasses import dataclass, field
from enum import Enum
from typing import Any
 
 
class StuckReason(str, Enum):
    NO_PROGRESS = "no_progress"
    LOW_CONFIDENCE = "low_confidence"
    POLICY = "policy_ambiguity"
    TOOL_ERRORS = "tool_errors"
    NEED_HUMAN_DATA = "need_human_data"
 
 
@dataclass
class EscalationBrief:
    run_id: str
    reason: StuckReason
    goal: str
    attempts: list[str]
    question: str
    urgency: str = "normal"  # normal | high
    evidence: dict[str, Any] = field(default_factory=dict)
 
 
QUEUE: list[EscalationBrief] = []
 
 
def should_escalate(
    *,
    identical_tool_hits: int,
    confidence: float,
    consecutive_tool_errors: int,
    needs_user_secret: bool,
) -> StuckReason | None:
    if needs_user_secret:
        return StuckReason.NEED_HUMAN_DATA
    if identical_tool_hits >= 3:
        return StuckReason.NO_PROGRESS
    if consecutive_tool_errors >= 3:
        return StuckReason.TOOL_ERRORS
    if confidence < 0.45:
        return StuckReason.LOW_CONFIDENCE
    return None
 
 
def escalate(brief: EscalationBrief) -> dict[str, Any]:
    QUEUE.append(brief)
    return {
        "status": "escalated",
        "reason": brief.reason.value,
        "queue_depth": len(QUEUE),
        "user_message": (
            "I need a human teammate for this step. "
            f"Question: {brief.question}"
        ),
    }
 
 
def route_queue(brief: EscalationBrief) -> str:
    if brief.reason is StuckReason.POLICY:
        return "compliance"
    if brief.urgency == "high" or brief.reason is StuckReason.TOOL_ERRORS:
        return "oncall"
    if brief.reason is StuckReason.NEED_HUMAN_DATA:
        return "requesting_user"
    return "support_l1"
 
 
# Demo: agent detects thrash and escalates instead of guessing
reason = should_escalate(
    identical_tool_hits=3,
    confidence=0.9,
    consecutive_tool_errors=0,
    needs_user_secret=False,
)
assert reason is StuckReason.NO_PROGRESS
brief = EscalationBrief(
    run_id="run-42",
    reason=reason,
    goal="Apply loyalty credit to account A-9",
    attempts=["get_account", "get_account", "get_account"],
    question="Account lookup returns 404. Correct account id?",
    evidence={"account_id_tried": "A-9"},
)
print(escalate(brief))
print("route:", route_queue(brief))

Deep Dive

Escalation is not the same as approval

Do not force every uncertainty through an "approve send" UI. Ask a clear question when the need is information or judgment.

Detection belongs in the host

Useful host-side detectors:

• Same tool+args signature N times
• Confidence head or verifier score below threshold (if you have one)
• Validator / schema failures after repair budget
• Tool error classes that are not transient
• Explicit model tool: escalate_to_human(question) (still enforce caps so it cannot spam)

Prefer code thresholds over hoping the model says "I'm stuck."

The escalation brief

Humans abandon walls of logs. Keep briefs short:

1. What the user wanted
2. What the agent tried (3-7 bullets)
3. What blocked progress
4. Exact question or decision needed
5. Links to trace / ticket
6. Deadline / urgency

Store the brief as structured data so routing and SLAs work.

Routing and ownership

Map reason codes to queues. Compliance questions should not sit in a general engineering Slack forever.

For customer-facing agents, distinguish:

• Ask the end user (missing preference, confirmation of identity within policy)
• Ask internal staff (policy edge cases, broken tools, account anomalies)

Never invent answers for identity, legal, or medical edge cases just to avoid escalation.

Resume vs hard handoff

Two valid outcomes:

1. Resume: human supplies a fact or decision; agent continues under the same run id.
2. Hard handoff: human takes the ticket; agent marks handed_off and stops tools.

Hard handoff is better when the remaining work is relationship-heavy or out of tool scope.

Confidence without theater

If you use model-verbalized confidence, calibrate it - models are often overconfident.

Pair verbal confidence with independent checks (retrieval agreement, regex/business rules, second model vote on critical paths) before you trust "low confidence" alone.

Gotchas

1. Silent guessing. The agent fills missing fields with plausible defaults and ships wrong actions.
2. Escalation spam. No budgets; every minor ambiguity pages humans until they mute the channel.
3. Transcript dump as handoff. On-call gets 40 tool payloads and no question.
4. Wrong queue. All escalations land on one engineer regardless of skill.
5. Side effects continue while waiting. Orders still place during "waiting on human."
6. No user-visible status. Customers see a spinner with no ownership.
7. Treating reject-from-approval as the only escalation. Stuck states happen on pure reads too.

Alternatives

FAQs

Related

• Human-in-the-Loop Basics - pause and resume basics
• Building an Approval Gate Before Irreversible Actions - consent for known actions
• Kill Switches: Stopping a Runaway Agent Mid-Execution - emergency stop
• Privilege Rings: Scoping What an Agent Can Do Without Asking - capability tiers
• Audit Trails: Logging Every Agent Action for Later Review - evidence packs
• Human-in-the-Loop Best Practices - checklist

Stack versions: Pins from the category manifest (verify at build): OpenRouter (~315+ models, July 2026 pricing/fees); LangGraph 1.0+; CrewAI 1.14+; Microsoft Agent Framework 1.0; Vercel AI SDK 6; Pydantic AI (latest); LlamaIndex (latest); OpenAI Agents SDK (latest + MCP); MCP (Linux Foundation governance); A2A (HTTP+SSE+JSON-RPC 2.0); Solana @solana/web3.js + @solana/spl-token.