Where should humans stay in the loop when AI agents perform autonomous coding tasks?

​ I’m trying to understand the right place for human review in an AI-agent workflow. Imagine an AI coding agent is working inside a real codebase. It can plan, edit files, run checks, stage changes, and maybe even prepare a PR. A simple loop could look like this: plan → edit → stage → check → handoff My question is: Where should the human reviewer be placed in this loop? Should humans review: plan → human review → edit → stage → check → human review Or should humans only review at the end? I’m especially thinking about risky systems like: auth payments database migrations security CI/CD config production logic If an agent is interacting with these parts of the system, should every change require human permission before it happens? Or is it enough to let the agent work, then review: what it planned to do what files it actually changed whether it drifted from the original intent what tests/checks were run My current thinking is that human review should not happen after every tiny edit, because that destroys automation. But humans should probably review at important gates: 1. Before editing: approve the plan/scope 2. After staging: verify the agent stayed within the plan 3. Before merge/deploy: final human approval I’m curious how experienced developers think about this. For autonomous AI coding agents, where should the human-in-the-loop actually be placed, and why?