Cloudflare Agents HITL: workflow approval or MCP elicitation?

Human-in-the-loop is too vague as an adoption rule. The useful question is where the agent should stop: a durable workflow, an MCP tool call, or one sensitive tool execution inside an existing agent loop.

Name The Risky Action First

Cloudflare's Agents documentation frames HITL around approvals, confirmations, and input before an agent proceeds. The practical trigger is a concrete action: payment, publishing, access change, data deletion, external communication, or another tool call with real consequences.

• Workflow approval: the reviewer may need hours or days.
• MCP elicitation: the server needs structured input to finish a tool call.
• Tool approval: one selected function call should pause before execution.

Use Workflow Approval For Durable Decisions

Cloudflare recommends workflow approval for durable, multi-step processes. That path is strongest when you need pending approval state, timeout handling, escalation, audit records, and a resume path after the decision.

This is the pattern for expense approval, access changes, publishing, and long-running operations where the reviewer is not guaranteed to be present in the same chat turn.

Use MCP Elicitation Or Tool Approval For Narrow Stops

MCP elicitation is better when a server needs missing structured input while a tool is running. Tool-level approval fits when an existing agent loop only needs to pause one risky call.

The same decision surface appears in other stacks: the Vercel AI SDK exposes `needsApproval`, while the OpenAI Agents SDK uses interruptions and resumable run state for sensitive calls.

Checklist Before Write Access

1. Name the proposed action, payload preview, actor, approver, and request ID.
2. Decide whether the approval can wait minutes, hours, or days.
3. Define timeout, rejection, retry, and escalation behavior.
4. Log the decision without silently rerunning rejected actions.
5. Verify that the run can resume from the same state after approval.