European Power Platform Conference, Copenhagen | June 30, 2026 | Track: Copilot and Agentic Platforms | Level 200
“The most trusted agents are the ones that know where to stop.”
That closing line from James Papadimitriou summed up the entire session in one sentence. T18 at EPPC26 was a masterclass in practical human-in-the-loop design — not as a theoretical principle, but as a concrete engineering requirement that every Copilot Studio builder needs to understand right now.
The Problem: More Autonomy, More Risk Surface
James and Petros started with a provocative premise: Copilot Studio agents fail their objectives not because they are unable to act, but because they don’t know when to stop.
The examples are familiar to anyone who has built or thought seriously about AI agents:
– An agent initiates a refund without getting approval
– A computer-using agent clicks submit on a form without verification
– An agent creates a database record with no human review
And the new Enhanced Task Completion (ETC) orchestrator in modern Copilot Studio agents makes this worse before it makes it better. ETC operates on a react loop: receive, reason, act, observe, adapt, repeat — continuously. This is what gives modern agents their power. It is also what expands the risk surface.
“More autonomy equals more risk surface.”
The Five-Layer Framework
The session was structured around five layers of human-in-the-loop control, ordered from softest to hardest:
Layer 1: Instructions
The primary control mechanism in modern agents. They must be concrete and unambiguous. Examples shown:
– “Never refund an amount higher than $500 without explicitly calling the approval request tool first.”
– “Never guess account numbers, policy IDs, or amounts.”
Instructions are necessary. They are not sufficient. An LLM can be manipulated into ignoring them.
Layer 2: Clarifying Questions
Teaching the agent to recognize uncertainty and ask before acting. The ETC orchestrator can batch multiple clarifying questions in a single response. Key triggers to design for:
– Multiple valid interpretations of the same request
– Missing mandatory parameters
– Requests that cross domains (HR + legal + finance)
– Vague language (“fix this”, “do that”)
The mental model: always design for the uncertain case, not just the happy path.
Layer 3: Workflow Gates — Hard Guardrails
This is the critical escalation from soft to hard control. Instructions are probabilistic — a sophisticated user or a prompt injection attack can sometimes get around them. Workflows are deterministic: the logic executes every time, regardless of what the LLM thinks.
The pattern: the agent calls an approval workflow before calling any execute-action tool. The workflow enforces the gate.
Current capabilities in Copilot Studio:
– Request for Information (GA since January 2026) — pauses the workflow and notifies a reviewer via Outlook or inline
– Multi-stage approvals (preview) — AI auto-approval stage + manual approval stage + conditions for dynamic routing
– Human Review action — built-in to the new workflow experience
New: Async response — until recently, an agent waiting for approval would fail after 100 seconds. This is now resolved. Enable asynchronous response and the agent can wait as long as needed.
Layer 4: Computer Use Agent (CUA) Supervision
CUA agents interact with desktop and web UIs directly — they click, type, navigate, and see screenshots. This makes them both powerful and uniquely vulnerable to prompt injection via screen content.
Key rules for CUA:
– Supervision is probabilistic (model-driven), not instruction-based — do not rely on it as a safety failsafe
– Only the maker or connection owner receives supervision requests
– Never put sensitive information in instructions that the agent itself could surface
– Always use trusted, isolated environments — never just point CUA at your main machine and let it run
Demo: a competitor price tracker that browses retail websites daily, extracts pricing data into Dataverse, and pauses to ask a human for guidance when it encounters an unexpected case (a product missing its SKU). The agent sends an email, waits, and resumes when a human responds.
Layer 5: Agent Feed
The highest level of human oversight — shifting the human from doing the work to supervising it.
Agent Feed surfaces agent-generated tasks inside model-driven Power Apps, powered by the Power Apps MCP server. Three tools:
– Request Assistance — agent can’t finish, needs human input
– Invoke Data Entry — agent suggests database record changes for human review
– Log for Review — agent completes work autonomously and logs everything for audit
Demo: an HR candidate screening agent that monitors new candidate records, evaluates each one against knowledge sources, and posts a recommendation (extend offer / request review / flag as not fit) directly into the HR team’s model-driven app — in real time, seconds after the record is created.
The Failure Modes to Design Against
Prompt Injection (XPIA)
Malicious content hidden in documents, tool results, or screenshots can trick an agent into ignoring its safety instructions. The ETC orchestrator’s dynamic reasoning makes this worse. The fix: never rely on instructions alone for critical gates — always pair them with deterministic workflow enforcement.
Approval Fatigue
The trap that catches many well-intentioned governance designs. If reviewers are bombarded with every approval request, they start rubber-stamping. The fix:
– Track approval rates — if auto-approved requests exceed ~30%, raise the threshold
– Categorize by risk area — only escalate what genuinely needs human judgment
– Use AI stages to auto-approve routine items; reserve human review for exceptions
– Measure the metric that matters: what percentage of the time does the human actually change the outcome? If it’s near zero, the gate is not providing value.
No-Go Zones and the Absent Tool Pattern
Some areas should be absolute no-go zones where agents never act autonomously:
– Legal and regulatory commitments
– Financial transactions above defined thresholds
– HR actions involving sensitive employee data
– Any situation where the user explicitly requests human review
And the most powerful safety measure of all: the absent tool. An agent cannot execute something it does not have access to. If an agent should not be able to approve a refund, don’t give it a refund tool. The LLM might bypass an instruction. It cannot bypass the absence of a capability.
Key Takeaways
- Human-in-the-loop is an engineering requirement — not an afterthought, not a UX feature, not a compliance checkbox. It must be designed in from the start.
- Instructions are necessary but not sufficient — always back them up with deterministic workflow enforcement.
- Workflows are your hardest and most reliable guardrail — they execute regardless of what the model decides.
- CUA supervision is probabilistic — useful, but never your primary safety mechanism.
- Agent Feed promotes the human from doer to supervisor — the right mental model for agentic AI in practice.
Session T18: “Where Copilot Studio Must Stop: Designing Human Escalation Without Breaking UX” — EPPC26, Copenhagen, June 30, 2026
Speakers: James Papadimitriou & Petros Feleskouras, Microsoft (Copilot Acceleration Team)