Three Teams, One Week, One Move: They Wrote the Handoff Down

Astro’s open issue count went from over 200 to about 30. An 85% reduction, on a repository with more than five years of accumulated history, and Matthew Phillips of Cloudflare expects zero sometime in the next month. That number is the headline. The mechanism underneath it is more useful.

What Cloudflare shipped is a label-driven state machine that moves an issue from triage needed to fix verified, with explicit ownership of every transition: some belong to the machine, some belong to a person. The machine is a written object. You can read it, review it in a pull request, and argue with it before it runs.

Three teams shipped versions of the same move in one week. Pamela Fox published a tiering scheme for MCP database servers. Cursor’s internal review platform leaked, and its design puts the handoff in a named tab. None of them coordinated. All three arrived at the same conclusion: the human handoff has to be an artifact, or it is not a control.

”Human in the Loop” Is a Policy Without a Mechanism

We drew four containment surfaces in April: compute, data, knowledge, identity. This piece sits on top of one of them. The human handoff is the surface every governance document claims to have and almost none of them specify.

Ask three engineers on the same team when an agent should stop and ask. You will get three answers, all reasonable, none written down. That is the failure mode. A policy that lives in a Slack thread has no version, no diff, no owner, and no way to be wrong in a reviewable manner. When the agent escalates too rarely, nobody notices until an incident. When it escalates too often, the humans learn to approve without reading, and the control quietly becomes decorative.

An artifact fixes the auditability problem before it fixes the safety problem. A label state machine has a commit history. A tool tier has a name and a permission set. A review tab has a queue with a length you can measure. All three give you the same thing prose cannot: a boundary that changes only when someone changes it on purpose.

Cloudflare: The Boundary Is a Label

The Astro triage bot runs sequential subagent phases named Reproduce, Diagnose, Verify, Fix. Each issue accumulates a report.md recording what the agent found. Proposed patches are validated against preview builds via pkg.pr.new before a human sees them. The whole thing was extracted into a standalone repository, triagebot-action, built on Flue, which means the design is reusable rather than tribal knowledge.

The escalation rules are the interesting part. Cloudflare routes agent failure to humans instead of automating around it, on the grounds that when an agent cannot reproduce an issue, the reason is usually a property of the codebase: an opaque abstraction, a missing document, a thin test. That is the production confirmation of an argument we made earlier about agent failure as a codebase report. Cloudflare did not treat it as a theory. It wired the signal into the workflow and cut 85% of a five-year backlog.

Community channels stay human, deliberately. The bot works issues; it does not answer people. That line is drawn in the label taxonomy, so a contributor can see where machine work ends without asking anyone.

Pamela Fox: The Boundary Is a Tool Tier

Pamela Fox, a Cloud Advocate in Python at Microsoft, published a four-tier ladder for exposing a database over MCP. Tier one is free-form SQL: a single execute_sql tool that will run whatever the model produces. Tier two adds progressive schema discovery through list_tables and describe_table, so the model stops guessing at column names. Tier three is execute_readonly_sql with validation. Tier four replaces SQL entirely with templated query tools such as search_species(q, limit).

The tiers map to use cases explicitly. Internal prototyping can live on free-form. Analytics workloads belong on read-only. Production and user-facing systems require templated queries, which means no arbitrary SQL reaches the database at all.

Her read-only enforcement is worth copying because it does not trust any single layer. AST parsing with pglast rejects anything that is not a SELECT. SET default_transaction_read_only = ON makes the session itself incapable of writing. A dedicated Postgres role holds least privilege at the database. A blocklist catches built-ins that read-only status does not cover, including pg_terminate_backend and pg_read_file. Limits cap results at 100 rows and queries at 30 seconds.

Then the handoff itself gets encoded in the protocol. MCP annotations readOnlyHint and destructiveHint tell the client what a tool does before it runs, and ctx.elicit() requests explicit human confirmation before a destructive action. The escalation point lives as a field on the tool definition, so the client can enforce it without the operator remembering a convention.

Cursor: The Boundary Is a Tab

TestingCatalog reported an unreleased internal build of what it calls Cursor Review, with two tabs added to the product: Codebase, for repository sync, and Review, for an automated pull request pipeline that notifies developers when their judgment is needed. The report is a leak. Treat it as development work in progress, and assume nothing about availability.

What makes it relevant is the structural choice, which survives even if the product changes shape. GitHub stays the source of record. The review surface is a queue the developer visits, and the pipeline decides what lands in it. That decision, whatever its internal logic, is now a component with a name, where before it was an implicit property of a chat interface. Cursor also demonstrated 22.6 commits per second at its Compile conference, per the same report. Vendor-demonstrated throughput at that scale makes the question of what reaches a human unavoidable, because the default answer at 22.6 commits per second is nothing.

What the Three Have in Common

The artifacts look nothing alike. A label taxonomy, a tool tier list, and a UI queue share no implementation. They share a property: each one names the exit condition of the loop and stores it somewhere with a version.

That property is what makes the boundary testable. Cloudflare can measure how many issues the bot escalated and whether the escalations were useful. Fox’s tier assignment can be audited by reading a tools file. A review queue has a length, a latency, and an abandonment rate. Prose in a governance deck has none of those.

It also makes the boundary movable on purpose. When Cloudflare wants the bot to handle a class of issue it currently escalates, that is a change to the state machine, reviewed like code. Compare that to the alternative, where the boundary drifts because an engineer got tired of approving the same thing and stopped reading.

Write Your Exit Condition Down This Week

Pick one agent already running in your environment. Do this in under an hour.

Name the exit condition. Write the sentence that completes “this agent stops and asks a human when…”. If you cannot write it in one sentence, what the agent has is a habit rather than a boundary.

Find where that sentence lives. A prompt string, a config file, a tool annotation, a workflow label, or nowhere. If the answer is a prompt string buried in application code, promote it to a file that gets reviewed.

Give it a version. Commit it. From that point, every change to the boundary shows up in a diff with an author and a date. That alone puts you ahead of most governance programs.

Measure the traffic across it. Count escalations per week and how many the human actually changed. Zero escalations in a month means the boundary is unmonitored, not quiet. A boundary where humans approve 100% without edits is rubber-stamping, and the verification work is not being done.

Pick your tier. For any agent touching a database, place it on Fox’s ladder and say so out loud. If a user-facing agent is on free-form SQL, you now have a dated decision to defend or fix.

Cloudflare’s 85% did not come from a smarter model. It came from a workflow where the machine’s job and the human’s job were written down separately, so each could be improved without guessing at the other.

---

This analysis synthesizes How we drove Astro’s issue triage toward zero (Matthew Phillips, Cloudflare, August 2026), Building Safe MCP Servers for Your Database (Pamela Fox, Microsoft, August 2026), and Cursor prepares to launch Origin platform for code reviews (Alexey Shabanov, TestingCatalog, August 2026).

Victorino Group helps engineering organizations turn implicit agent handoffs into versioned, measurable escalation boundaries. Let’s talk.