> ## Documentation Index
> Fetch the complete documentation index at: https://docs.world.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Human in the loop

> Pause an agent workflow and require fresh World ID authentication before continuing.

## Human checkpoints

Pause the agent workflow, complete the [step-up procedure](https://docs.world.org/agent-pass/step-up.md#implement-step-up),
and resume only after your backend accepts the authentication, checks permissions,
and confirms any action approval required by your policy. This works with your
existing sign-in or World ID as your primary sign-in.

### Optional: collect action approval in your application

Save the exact action, version, destination, owning account, and expiry, bound
to the authentication attempt. After validating the account and assurance, show
the saved action to the user and record their approval or denial. At execution,
recheck permissions, expiry, freshness, and approval, and authorize only that
version. Changes require new approval. Denial, cancellation, failed validation,
or expiry leaves the action blocked. Apply the
[one-use and retry rules](https://docs.world.org/agent-pass/step-up.md#prevent-stale-or-duplicate-operations).

For `max_age=0`, authentication belongs to the newly initiated attempt. Enforce
your application's freshness window when the action runs, including time spent
reviewing it.

For headless clients, follow the [Device Authorization Grant](https://docs.world.org/agent-pass/connect-your-backend.md#sign-in-a-headless-agent-device-flow).
Your backend issues their API or MCP credentials. Where supported, use the
[challenge and retry flow](https://docs.world.org/agent-pass/step-up.md#challenge-an-agent-or-api-client-rfc-9470).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.