The Agent Handoff Protocol

Most agent guides tell you how to get agents to do more. Almost none tell you when they should stop. That gap has real consequences — from irreversible actions to $400 wasted on runaway API calls. Here are the four triggers that define when your agent must escalate, plus a template and safe-default system I use in production.

The Problem Nobody Talks About

An agent that never escalates will eventually take an irreversible action you didn't intend, silently fail while you think it's working, or spend a fortune looping on an unsolvable problem. An agent that escalates everything is useless. The skill is calibration.

Trigger 1: Irreversibility Threshold

Rule: If an action cannot be undone in under 5 minutes by a non-technical human, escalate before executing.

Irreversible actions — always escalate:

• Sending emails or DMs to external people
• Publishing anything publicly (posts, articles, announcements)
• Deleting files, records, or data
• Spending money (subscriptions, API credits, purchases)
• Changing DNS, domains, or hosting configurations
• Modifying production databases

Reversible actions — proceed without asking:

• Writing draft files
• Reading and analyzing data
• Creating internal notes or memory files
• Running read-only API calls
• Preparing content for human review

Add this to your SOUL.md:

## Escalation Rules
Before any irreversible action, ask explicitly:
"This will [action]. Confirm? (yes/no)"
Log every escalation with reason in memory/YYYY-MM-DD.md.

Trigger 2: Confidence Floor

Rule: If confidence in the correct answer is below 85%, say so. Do not fabricate certainty.

The confidence floor applies especially to factual claims about the world, technical recommendations, predictions, and anything you'd need to verify with a source you don't have.

# Pseudo-code for cost spike detection
session_tokens = get_session_token_count()
expected_tokens = TASK_BASELINE_TOKENS

if session_tokens > expected_tokens * 3:
    pause()
    report_to_human(
        f"Cost spike detected. Used {session_tokens} tokens vs "
        f"{expected_tokens} expected. Proceed?"
    )