What happens when an AI agent hits a step that legally requires a human signature?

When an AI agent reaches a step the law reserves for a person — a signature, a consent, a notarization — it does not stall and it does not die untyped. It emits a typed NEEDS_HUMAN Handoff: a structured envelope carrying url · signed shortUrl · pollUrl · expiresAt. The human receives the signed, expiring shortUrl, opens exactly the one decision it authorizes, and signs or consents in seconds. The agent, meanwhile, polls pollUrl — an RFC 8628 device-flow poll, GET and side-effect-free — and the moment approval lands, the signed artifact posts to the deal record and the flow continues without re-acquisition. The human appears for exactly the one act the law reserves for them, and distance-to-done never resets.

That is the whole answer. The rest is the mechanics — what the envelope is, why it is typed, and how the resume works — because a flow you are going to trust with a legally-bound moment deserves to be shown, not asserted.

Why "typed" is the load-bearing word

Most automated flows die at the signature the same way: they hit a step a machine cannot perform and return something a machine cannot read — a redirect to a login wall, a form, a "contact us," an HTTP 200 with a human-shaped page inside it. The agent has no way to know whether it hit a genuine legal requirement or a UX dead end, so it either retries into a loop or abandons the session. The deal was ninety percent done and now it is gone.

A typed outcome removes the guesswork. On these rails every gate returns one of exactly two shapes:

• OFFER — posted price · hard Mandate ceiling · x402 accepts. The machine transacts under its ceiling with nothing to negotiate and nothing hidden to discover.
• NEEDS_HUMAN — url · signed shortUrl · pollUrl · expiresAt. A person must appear, once.

Because there are only two shapes, an agent can plan an entire deal against the gates before it walks them: every stop is one it can either settle or hand off, and every wait is resumable. A gate that returns anything other than these two shapes is not a hard case to handle — it is a conformance failure. The signature step is not an exception the flow trips over; it is a first-class, addressable outcome the flow was built to emit.

The envelope, field by field

The NEEDS_HUMAN body is small on purpose. Four fields carry the entire human moment:

• url — the gated step itself, addressable. The same tool that returned the envelope returns it verbatim on request; the moment is a place, not a modal that vanishes.
• shortUrl — signed and expiring. This is the human's link, and it opens the one decision and nothing else — no dashboard, no account to create, no adjacent actions to fat-finger. Signed so it cannot be forged; expiring so a stale link is inert.
• pollUrl — where the agent waits. It returns authorization_pending until the human appears, per RFC 8628. GET is side-effect-free: polling changes nothing but the asking, so the agent can wait without consuming or committing anything.
• expiresAt — posted with the envelope. A lapsed Handoff re-issues; it never dangles. Until it lapses, the flow waits — it never dies.

The human's experience compresses to seconds because the envelope did the work of isolating the decision. There is no afternoon at a desk around the one act — the agent already read the record, settled the OFFERs under its Mandate ceiling, and posted every step to the deal ledger before the human's calendar was ever touched. The person is handed a single, load-bearing decision with all its context already on the record, and everything the agent did survives being shown to them afterward — because the receipt is the deal record itself.

The resume, per RFC 8628

The device-authorization flow (RFC 8628) exists precisely for the shape of this problem: one actor needs an authorization that only a second actor, on a different device, can grant. The agent holds the pollUrl and asks on an interval; the human holds the shortUrl and decides. When approval lands, the signed artifact posts to the deal record and the agent resumes from exactly where it paused. Nothing is re-acquired, nothing re-priced, no distance-to-done recovered from scratch. The human appeared, and the deal picked up mid-stride.

This is what "the human at exactly one step" means as a shipped shape rather than a slogan: the agent walks every other step, and the person is inserted at precisely the moments the decision is load-bearing — payment authorization, consent, signature, notarization — and nowhere else.

Where the motion runs in production

None of this is a diagram. The buy.vin checklist runs the motion in production: a buyer's agent walks the deal by VIN, and the human appears at Authorize Bank, eSign, Upload License, Notarize POA, and payment. Notarize POA is a credentialed fn:Human leaf — a notarization, one of the most tightly reserved acts there is, expressed as an addressable Handoff inside the proven 7-step checklist, with the signed artifact returning to the deal record. If a notarization can be a typed leaf, so can the signature step in your flow.

Every Handoff on these rails runs on the same plug-in surface: one key, one MCP server at apis.vin/mcp, with metering posted at apis.vin/pricing. The free face is the record itself — on b2h2a.vin, curl -H 'Accept: application/json' https://b2h2a.vin/{VIN} reads it keyless — and the cost-bearing faces are the metered tool calls that transact on it. You plug your gated moments into the rails, and the moment your flow reaches a step the law reserves for a person, it emits the envelope instead of a dead end.

The check digit certifies; it never sells. The Handoff is the same discipline applied to the one place a machine cannot go: the human appears for exactly the one act the law reserves for them, typed, signed, expiring, and resumable — and the deal keeps its distance-to-done the whole way.