Human-in-the-Loop AI Scheduling: Design a Clean Reclaim Boundary

Build a clean agent-to-human reclaim path in eight steps

Use one sixty-minute customer escalation meeting with an organizer, three required people, one optional CFO, mixed Google and Microsoft calendars, and one required participant who will not connect a calendar. The agent can coordinate routine availability but cannot authorize protected-time release or change the CFO’s role.

1. 1

   Write the meeting intent and completion contract

   Persist authenticated organizer, purpose, duration, bounded date range, deadline, IANA zones, required and optional people, approved substitutes, preferences, outreach policy, approval mode, organizer calendar, allowed actions, and terminal proof. Define success as one read-back event with required invitations, not a message draft, poll winner, suggested slot, or tool success.
   • Required attendance and approval are deterministic policy fields.
   • The transcript is provenance, not the durable meeting database.
   • No-overlap, consent refusal, and authority gaps have bounded states.
2. 2

   Map machine authority and human judgment separately

   For free/busy reads, participant outreach, reminders, proposal creation, protected-time release, role changes, event writes, rescheduling, cancellation, and disclosure, name the authorized actor and conditions. The agent can carry settled policy. A human owns relationship, priority, risk, or exception decisions not already delegated.
   • Possessing a calendar token does not grant business authority.
   • A participant reply cannot expand the agent’s permissions.
   • Every sensitive action has a visible approval or reclaim rule.
3. 3

   Join connected and conversational availability

   Read approved Google and Microsoft free/busy for connected required people. Ask the unconnected participant for bounded windows through an approved channel with purpose, local time, deadline, reminder cap, correction, and opt-out. Normalize identity, source, IANA zone, consent, freshness, expiry, and provider errors before matching.
   • Calendar connection is optional and helpful, not the product category.
   • Missing access, silence, and expired evidence are unknown rather than free.
   • Optional people are ranked only after every required person passes.
4. 4

   Trigger reclaim on a typed boundary, not model discomfort

   Open reclaim when policy names an authority gap, relationship-sensitive wording, protected-time conflict, ambiguous identity, consent problem, no-overlap decision, deadline risk, provider uncertainty, repeated failure, or explicit human request. Record trigger, meeting revision, affected dependencies, expiry, current owner, and which external actions must pause.
   • The trigger explains why the agent cannot continue safely.
   • A low model confidence score alone does not invent a business owner.
   • Unrelated meetings and participants remain outside the handoff.
5. 5

   Freeze side effects and create one decision packet

   Stop proposal, reminder, booking, reschedule, and cancellation workers for the affected revision. Give the human the purpose, exact decision, local times, required and optional roles, current evidence, privacy-safe constraints, deadline, available choices, and consequences. Keep private calendar details and full participant transcripts out unless access is required and approved.
   • The human receives one decision rather than a conversation dump.
   • Late replies are stored and classified without restarting side effects.
   • The packet names what happens if no decision arrives by expiry.
6. 6

   Transfer control under one revision lock

   Issue a claim token or equivalent control tied to meeting, revision, actor, scope, and expiry. Mark whether the human may edit intent, approve a proposal, change participant roles, send relationship wording, write the event, or close the meeting. Reject stale decisions and keep a redacted record of who changed what.
   • Agent and human cannot write competing proposals for the same revision.
   • A decision for one slot cannot authorize a later slot or attendee set.
   • Reclaim can be transferred or returned without losing meeting identity.
7. 7

   Resume from the authorized delta

   Append the human decision as a new meeting revision. Preserve still-valid participant windows and free/busy evidence; refresh only dependencies made stale by the change. Recompute required overlap, apply time zones and optional roles, bind approval, then use one idempotent booking operation. Reconcile uncertain provider state before retry.
   • The agent does not restart participant outreach from zero.
   • A human exception changes only the fields and scope they authorized.
   • Repeated resume commands cannot create a second event.
8. 8

   Verify completion and make the control path observable

   Read back time, zone, organizer, every required participant, optional decision, approved wording, and invitation state. Trace intent revisions, participant waits, evidence, reclaim triggers, claim ownership, human decisions, resumed work, booking attempts, retries, reconciliation, and final proof. Close with a verified booking, authorized cancellation, or bounded unresolved exception.
   • Operators can see whether the agent, human, participant, or provider owns the wait.
   • Logs redact message and calendar content while preserving decision evidence.
   • Human involvement is measured as a state transition, not hidden manual cleanup.

Compare agent control by how judgment enters the workflow

The useful architecture neither hides the human nor makes the human rebuild the meeting. It transfers one decision and resumes from current state.