Most agent frameworks have some version of a pause button. Fine. But pausing only matters if the place you paused is somewhere you can actually walk away from.
A draft application saved but not submitted sits still until someone comes back. A payment already captured keeps propagating through merchant systems whether or not the agent is running. The stop mechanism is identical in both cases. What differs is whether the world outside your system has already started moving.
Stage automation engineers figured this out decades ago. An emergency stop doesn't freeze every motor mid-travel — it drives the machinery to the nearest designed safe position. The real work happened before the show opened, when someone mapped out where those positions were.
Agent systems need the same pre-work. Before a workflow runs, someone has to specify which intermediate states preserve your options and which ones have already spent them. A checkpoint records where the agent was. A safe state means that position is okay to leave unattended, that nothing external is still moving on the agent's behalf.
Spending caps don't get you there. They bound total damage without describing what state the world is in when the agent stops.
Safe to leave — options preserved:
- Cart filled, not purchased
- Draft saved, not submitted
- Payment authorized, not captured
- Code branch created, not merged
- Research compiled, not acted on
Unsafe to leave — external systems keep moving:
- Payment captured (reversal requires merchant cooperation)
- Email or notification sent (cannot be unsent)
- Reservation canceled on an external platform
- Credentials obtained and used in third-party services
What safe-state design records:
- Which interim holds are still active
- What remedy is available and when it expires
- Who has authority to resume, reverse, or compensate
- Current state as understood by each external system
Where frameworks fall short: Tools like LangGraph offer checkpoints — replayable snapshots of execution state. A checkpoint captures where the agent was, not whether that position is safe to leave or what external obligations it already created.