Self-Healing Agents Don't Decide When Humans Step In. You Do.

By Raymond Todd Blackwood, President of QuickLaunch

A year ago this week, the most automated infrastructure on the planet tried to heal itself and made everything worse. Amazon's own postmortem of the October 2025 outage in its largest cloud region tells the story plainly: two automated systems that maintain DNS records raced each other and left the regional endpoint of one of the internet's most depended-upon services with an empty address record. Then two of AWS's automatic recovery mechanisms piled on, pulling healthy capacity out of service and backing up into what the postmortem calls congestive collapse. The fix was not more automation. It "ultimately required manual operator intervention," in Amazon's words, and afterward the company disabled that automation worldwide.

Hold that story while you read this one, because self-healing agents just arrived on your campus. Platform after platform now sells workflows that detect their own failures and repair them, and our own platform ships with self-healing agents on by default. Last week I promised you this column, and here is the question it owes you: when the workflow can fix itself, when do humans need to be in the loop?

Here is the answer to carry into your next architecture meeting. A human belongs in a self-healing workflow at three points: at design time, deciding which classes of failure the agent may fix on its own, judged by impact and reversibility; at the boundary, approving any action that cannot be cheaply undone; and after the fact, as a named owner who reads the healing log the way you read a bank statement. What a human should not be is a click inside every loop. A person who approves everything is approving nothing.

In September I wrote that the sentence became the program, and that a sentence with no owner is just technical debt with better grammar. Self-healing raises the stakes on exactly that point, because now the program can quietly rewrite itself.

The Industry Shipped the Healing. It Can't Agree Where You Belong.

Survey the self-healing agents vendors actually ship and you find the same feature wearing three different relationships to the human race. ServiceNow's troubleshooting agent diagnoses failures but will only recommend remediation actions after receiving user confirmation, and its documentation is explicit that the agent runs with your privileges and can never exceed them. Microsoft's Entra policy agent will not change an existing policy, in Microsoft's own words, "unless an administrator explicitly approves the suggestion." That is the approval-gate school.

Then there is the repair-first school. Microsoft's self-healing for desktop automation repairs failing flows at runtime and leaves the permanent correction for a human later, and Microsoft candidly warns that the generative AI underneath "might occasionally identify an unintended UI element." UiPath's Healing Agent repairs user-interface automations automatically, and notably ships a recommendation-only mode for teams that want the diagnosis without the autonomy. The third school is silence: one platform's own recovery framework is described as operating "without human intervention," and others ship the healing with no oversight language at all, the question left entirely to the customer.

I have a prediction on record: agentic capability would land inside the major platforms while the how-to-implement stayed your problem. It keeps holding up. The industry has collectively decided agentic workflows should heal themselves, and it has collectively declined to decide where you fit. That decision, like every governance decision this year, lands on your campus by default.

The Best Case Against Self-Healing Was Written by Its Biggest Fans

The AWS story is the latest entry in a genre the hyperscalers have been publishing for years, and higher-ed IT should read their postmortems the way our auditors read ours. In 2018, GitHub's database automation responded to a 43-second network blip by failing its primary databases across the country, and its post-incident analysis holds the genre's most instructive sentence: the automation "behaved as configured, despite our application tier being unable to support this topology change." In 2021, Facebook disappeared from the internet for hours, and the self-protective behavior that amplified a maintenance error was working exactly as designed. Google's own Site Reliability Engineering book, the bible of this discipline, admits automation has been "actively harmful on a number of occasions" and documents a decommissioning system that wiped the disks of an entire content-delivery fleet because an empty machine list was read as all machines.

Read the genre carefully and the pattern is never "the machine went rogue." The pattern is that somebody granted automation a scope no one had thought through, and the humans discovered the real boundary during the outage. The remedy, in every single postmortem, was not stationing a person inside the loop to watch retries. It was narrowing, at the design table, what the automation was allowed to do by itself: GitHub constrained its failover, and Amazon shut its DNS automation off until it could be redesigned.

There is a quieter cost in the Google book that should bother a registrar's office more than any outage: as automation absorbs the work, the operators' "mental models of what the system should be doing no longer reflect the reality of what it is doing." A workflow that silently repairs itself is a workflow that drifts from its documentation, one unlogged fix at a time. I have been writing about ghost accounts all year; a self-healed workflow nobody reviews is how a ghost gets born at machine speed.

A Human in Every Loop Is a Human in No Loop

So put a person in front of every agent action and sleep well? The evidence says that checkpoint fails on schedule.

Anthropic, which builds the models inside many of these agents, measured what happens when software asks humans for permission at scale: users accept 93 percent of permission prompts. Its engineers call the pattern approval fatigue: people stop paying close attention to what they're approving. Security people have known the shape for years: a USENIX field study of twenty-five million browser warnings found users clicking through 70 percent of Chrome's SSL warnings. The 2022 Uber breach began with an attacker simply spamming a contractor with MFA approval requests until, in Uber's own words, "the contractor accepted one." And legal scholar Ben Green surveyed the research behind dozens of human-oversight policies and concluded that the evidence "suggests that people are unable to perform the desired oversight functions." An approval requirement can quietly become a way of laundering responsibility onto whoever clicked.

Earlier this month I wrote that if your access reviews are rubber stamps, bolting agents onto them scales the theater. The same law governs here. OWASP's new agentic security guidance even has a name for the failure mode: governance drift cascade, where "human oversight weakens after repeated success" and bulk approvals wave through whatever comes next. A human in the loop is a control only where the human has the context, the time, and a real decision to make. Everywhere else it is a ritual, and rituals get exploited.

Autonomy Is Granted by Failure Class, Not by Faith

Higher ed just voted this exact tension onto its own agenda. The sector's 2027 EDUCAUSE Top 10 list, released at the annual conference this fall, put determining where AI adds real value at number one, and balancing cybersecurity boundaries with autonomy and trust at number three. Institutions are writing doctrine too: Siena College now requires "defined limits on autonomy" and explicit institutional approval before an agentic system deploys. What nobody hands you is the decision rule. NIST, which I checked again this week, still publishes no agent-specific criteria for when a human must approve; its agent standards effort is gathering input.

The best published rule comes from a source your CISO already trusts. In May, the cybersecurity agencies of the United States, the United Kingdom, Canada, Australia, and New Zealand issued joint guidance on adopting agentic AI that reads like it was written for this column. Classify every action an agent can take "by potential impact, likelihood and reversibility." Prevent agents from autonomously executing high-impact actions without prior human approval. Grant autonomy gradually, as the system earns it. And one rule so specific you can hear the incident behind it: quarantine any request to delete logs or audit records until a human approves. Microsoft's design guidance for its own agent platform draws the same three-tier boundary, routine actions run free, risky ones confirm in the moment, consequential ones wait for offline approval, and then adds the warning every vendor should print: don't rely on human review as a fail-safe.

Translate that to the self-healing agents working between Banner and Brightspace. Retrying a transient API failure, refreshing an expired credential, re-running a batch that died mid-stream: enumerable, reversible, boring. Let the agent heal those forever, nobody needs to be in that loop. Re-mapping a field because the SIS schema changed is a different animal, because a plausible-looking mapping can be plausibly wrong about meaning, and wrong meaning flows downstream into FERPA territory. That one gets a dry-run diff and a human yes. And anything irreversible, deleting accounts, releasing records, moving money, touching the audit trail, waits for a named person no matter how confident the agent is.

Our product is in this fight, so you should know exactly what it does and where its leash ends. The iPaaS Agentic Design Studio ships with self-healing on by default: the agent monitors every data flow, detects failures, and auto-remediates common issues before your team sees a ticket, with everything visible on a real-time dashboard and a sandbox to test in before anything touches production. The human loop around it is structural, the pattern I described when our platform gave AI agents first-class identities: every agent has a named owner, an audit log that separates what it did autonomously from what it did on a person's behalf, and an emergency revocation switch. The limits, in print as always: auto-remediation covers the common failure classes, not the exotic ones, and our documentation today describes no per-action approval gate inside a healing cycle. And no product on this market, ours included, can classify the impact and reversibility of your actions for you. That classification is the design work, and it is yours.

The week's assignment fits on one page. Pick one load-bearing workflow. List every action it can take, not every action you intended. Mark each one reversible or irreversible, low-impact or high. Grant the agent the first list, on the record. Put a name next to the second list. Then read the healing log on Friday and see what your newest employee fixed without telling anyone. And keep one human hand near the off switch, the one control that must never be automated. Fluency, not faster clicking, is the real argument for keeping humans in the loop: someone has to know the system well enough to take it back when it matters. Next week the calendar turns spooky, and so does the column: ghost accounts, and why the scariest thing on your campus has a working password. See you Wednesday.

Take the Next Step

Primary: See the pattern governed end to end: the iPaaS Agentic Design Studiobuilds and heals Ethos-native workflows with self-healing on by default, and first-class identities for AI agents put a named owner, a separated audit log, and an emergency revocation switch around every agent. Current capability detail lives in the release notes.

Secondary: Follow the weekly column on the QuickLaunch blog. Next week: ghost accounts, just in time for Halloween.

FAQ

What is a self-healing agent in an integration workflow?

A self-healing agent is software that monitors an automated workflow or integration, detects failures such as rejected API calls, changed interfaces, or stalled data flows, and repairs the common cases without waiting for a human. Examples in production include UiPath's Healing Agent for user-interface automations, Microsoft Power Automate's self-healing preview for desktop flows, and QuickLaunch's iPaaS Agentic Design Studio, which monitors campus data flows and auto-remediates common data-flow failures by default.

When should a human approve an AI agent's actions?

Joint guidance published in May 2026 by the cybersecurity agencies of the United States, United Kingdom, Canada, Australia, and New Zealand says agent actions should be classified by potential impact, likelihood, and reversibility, that agents should be prevented from autonomously executing high-impact actions without prior human approval, and that requests to delete logs or audit records should be quarantined until a human reviews them. Microsoft's agent design guidance draws the same line: routine actions run without confirmation, medium-risk actions confirm with the user in the moment, and mission-critical or irreversible actions such as payments and deletions require an approval workflow.

What caused the AWS outage in October 2025?

Amazon's postmortem attributes the October 19-20, 2025 outage in its US-EAST-1 region to a latent race condition in the DynamoDB DNS management system: two automated DNS Enactors applied plans out of order, leaving the regional endpoint with an empty DNS record. Automated recovery could not repair the state, manual operator intervention was required, and AWS disabled the DNS Planner and DNS Enactor automation worldwide while it added safeguards. Secondary effects came from automatic mechanisms, including network load balancer health-check failovers that removed healthy capacity and congestive collapse in EC2's lease-recovery workflow.

Does QuickLaunch's iPaaS include self-healing integrations?

Yes. The QuickLaunch iPaaS Agentic Design Studio ships with self-healing on by default: an agent that knows Ellucian Ethos APIs natively monitors every data flow, detects failures, and auto-remediates common data-flow issues before they become tickets, with a real-time dashboard and a sandbox for testing before production. Human oversight is structural rather than per-action: each AI agent gets a first-class identity with a named owner, an audit log separating autonomous actions from on-behalf-of actions, and an emergency revocation action. Auto-remediation covers common failure classes, and QuickLaunch's documentation does not describe a per-action human approval gate inside a healing cycle.

References

• Summary of the Amazon DynamoDB Service Disruption in the Northern Virginia (US-EAST-1) Region - Amazon Web Services.
• Self-service conversational troubleshooting (AI Admin Center) - ServiceNow Documentation.
• Microsoft Entra Conditional Access optimization agent - Microsoft Learn.
• Self-healing (preview) in Power Automate for desktop - Microsoft Learn.
• Healing Agent setup and healing modes - UiPath Documentation.
• Autonomous Operations Framework (accelerator) - Workato.
• October 21 post-incident analysis - GitHub.
• More details about the October 4 outage - Meta Engineering.
• The Evolution of Automation at Google - Site Reliability Engineering, Google.
• Making Claude Code more autonomous, safely: Auto Mode - Anthropic Engineering.
• Security update - Uber Newsroom.
• Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness - USENIX Security 2013 (Akhawe & Felt).
• The Flaws of Policies Requiring Human Oversight of Government Algorithms - Ben Green, Computer Law & Security Review (preprint).
• OWASP Top 10 for Agentic Applications for 2026 - OWASP GenAI Security Project.
• Careful adoption of agentic AI services (joint guidance) - Canadian Centre for Cyber Security, ASD, CISA, NSA, NCSC-UK, and NCSC-NZ.
• Careful Adoption of Agentic AI Services - CISA.
• Apply generative orchestration capabilities - Microsoft Learn (Copilot Studio).
• Human supervision of computer use - Microsoft Learn (Copilot Studio).
• Announcing the AI Agent Standards Initiative - National Institute of Standards and Technology.
• AI Leads 2027 EDUCAUSE Top 10 - Campus Technology.
• Institutional Use of Generative and Agentic Artificial Intelligence - Siena College.
• QuickLaunch Release Notes - QuickLaunch.

Raymond Todd Blackwood is the President of QuickLaunch and writes about identity, agentic AI, and the messy reality of higher-ed IT. #ItsExistential