Who reviews your AI agents while you're on holiday

You leave on the 4th and you are back on the 18th. Five agent sessions are open on your board, and you are the only person who can say what any of them was asked to do, or how far it got.

Every piece of review guidance for agent output assumes you are still at your desk. GitHub's May 2026 article on reviewing agent pull requests is blunt: "Reviewing your own pull request isn't optional when agents are involved." It also assumes whoever commissioned the run stays reachable, and two weeks off breaks that.

The honest part first: Taskfolk has no out of office field, no coverage toggle, no delegate setting. I went looking in the schema and there is nothing to switch on. What follows is built from parts that do exist, and you undo some of it by hand when you get back.

What actually breaks when you go quiet

Almost nothing visible breaks, which is the problem. A ticket held by an agent that runs past its due date sends no reminder email to anyone. The daily digest is built per person from issues where that person is the assignee, and the sweep behind it skips agent users, whose synthetic addresses would bounce. Your covering engineer is not the assignee. The agent is.

Session notifications do fire. Entering needs input, review, done or failed notifies the agent's owner plus the issue's reporter, assignee and watchers. On a ticket you commissioned yourself, those four slots are usually all you. The alerts work exactly as designed and land in an inbox nobody is opening.

Two more clocks run without you. Assignment auto creates a pending session, and the worker cancels pending delegations nobody claims for seven days, so a fortnight of leave trips that in week two. If you set a spend cap, the alert fires once and goes to the owner: Taskfolk never runs the model, so it can flag the crossing but cannot stop it.

The owner field is where this gets awkward. It is written once, when someone connects the agent, and nothing in the product moves it afterwards. You cannot hand your agents over. A colleague either holds the owner or admin role, which is what managing someone else's agent requires, or they work through the ticket instead.

In a January 2026 Cloud Security Alliance survey of 228 security and IT professionals, 15 percent were unsure who is responsible when an AI agent takes an unintended action. Among those who did answer, it split between security, engineering and product.

Both obvious options cost you the fortnight

Freeze everything and you park capacity that costs nothing to keep: connected agents are excluded from seat counting, so three humans running nine agents pay for three seats.

Let it all run and you come home to a queue that was slow before you left. LinearB's 2026 benchmarks, drawn from 8.1 million pull requests across 4,800 teams, found AI pull requests wait 4.6 times longer before anyone picks them up, and agentic ones 5.3 times longer. Acceptance sits at 32.7 percent against 84.4 for manual work. The delay is in pickup rather than review, and pickup is what your absence removes.

Then the tail risk. In February 2026 Fortune reported that Summer Yue, a Meta safety researcher, watched her OpenClaw agent delete her entire inbox after it lost the instruction to pause and confirm. It had run safely for weeks against a test inbox, and failed the first time it was pointed at the real one.

Neither option is a policy. Both are what people do instead of triage.

Triage every session, not every repository

Do this the day before you leave, one session at a time. It takes about fifteen minutes, because "what is in flight" is a query, not a memory. Every delegation is a durable session row with a state: pending, running, needs input, review, done, failed, cancelled. Stall is derived at read time after thirty minutes without a heartbeat, so a session that died on the 3rd looks dead rather than busy.

flowchart TD
  A["Open session"] --> B{"Could a bad finish cost money or data?"}
  B -->|"Yes"| C["Freeze: cancel, unassign"]
  B -->|"No"| D{"Needs a judgement only you can make?"}
  D -->|"Yes"| E["Park in needs input, question written down"]
  D -->|"No"| F{"Can someone else judge the output?"}
  F -->|"Yes"| G["Run supervised: second owner"]
  F -->|"No"| H["Run unattended: no merge rights"]

Bucket	Before you leave	What the covering engineer does
Freeze	Cancel, unassign, note why	Nothing, on purpose
Run unattended	Strip write scope, remove repo merge rights	Nothing unless it goes overdue
Needs a human	Reassign, add a watcher, write the ask	Reads, decides, unblocks

Pull the same list for the handover with an agents:read key. The state filter takes one value per call, and rows come back newest activity first.

curl -s "https://taskfolk.ai/api/v1/workspaces/acme/agent-sessions?state=running" \
  -H "Authorization: Bearer tfk_live_a1b2..."

r = requests.get(
    "https://taskfolk.ai/api/v1/workspaces/acme/agent-sessions",
    params={"state": "running"},
    headers={"Authorization": "Bearer tfk_live_a1b2..."},
)

{
  "data": [
    {
      "agent_name": "Omar's Claude Code",
      "state": "running",
      "issue_key": "WEB-142",
      "note": "tests green, PR not opened",
      "external_url": null,
      "last_activity_at": "2026-08-03T16:41:09.000Z"
    }
  ]
}

Name a second owner per session

Not per repository. A repository level backup gets a list of pull requests with no way to tell which were commissioned and which are an agent misreading a ticket.

Because agent ownership does not move, the second owner is a convention layered onto the ticket. Reassign the issue from the agent to that person, which puts it in their daily digest, or add them as a watcher on just the tickets that matter, which pulls them into the session notifications without changing who holds the work.

incident.io's on call guide, updated 27 February 2026, notes that many teams make last week's primary this week's secondary so the backup carries real context. Pick whoever last reviewed something from that agent, not whoever looks least busy.

One real limit on the fleet wide glance: a view stores a single assignee, not a set, so no saved view can mean "anything held by any agent". You get one per agent, or the Agents hub.

Shrink what each agent may touch

Every agent's allowlist is drawn from fourteen writable issue fields: title, description, status, priority, assignee, labels, milestone, sprint, release, estimate, spent, completion, start_at and due_at. Null means all of them. Enforcement sits at one API write choke point covering REST, the transition endpoint and MCP, so there is no second door.

For a leave window I cut it back to what an agent needs to report progress: status, completion, spent. Take away assignee so it cannot hand work to itself or to someone else who is away, and priority so it cannot promote its own ticket above what your covering engineer is watching. Mechanics: how to set agent field permissions.

The policy is per field, not per value: an agent may write status or it may not, and you cannot say "only ever to In Review". It governs issue fields only, so it cannot stop an agent writing code or merging a branch. That is branch protection's job. It shrinks the blast radius without changing what the agent reads, which is the separate problem in prompt injection starts in the ticket.

The other control is the status column. Allowed transitions are a hard gate: a disallowed move errors on every write path, automations included. WIP limits are not, so the count badge turns red and nothing refuses the card.

The ticket is the handover

A human PTO template already asks the right questions. Nobody has mapped them onto agent work, so here it is.

PTO template field	Agent equivalent	Where it lives
Coverage contact	Second owner per session	Assignee or watcher
Authorization scope	Field allowlist, allowed transitions	Agent profile, statuses
In flight work	Open sessions and their states	Agents hub, session card
Verified so far	Attributed activity and comments	Issue activity feed
Emergency threshold	Escalation rule, written down	Automations, the comment
Do not decide without me	Frozen sessions, named	Cancelled sessions

The session record streams onto the ticket while the agent works, and every write carries the agent's own identity, because its API key was minted with the agent's user id as creator. Your covering engineer reads the activity feed, not a status claim.

The unverified badge helps, within limits. It flags a session in review or done whose agent left no activity row and no comment on that issue inside the session's window. One comment defeats it, and so does a pull request link on the session, which counts as evidence before anything else is checked. A tidy session list is not proof that work happened, and we do not read diffs or judge code quality.

Then write the ask down, as a comment on each live ticket:

Handover, 4 to 18 August. Second owner: @priya
Ask: replace the PDF renderer, keep the current API surface.
Verified: unit tests pass, invoice-golden fixtures updated.
Not verified: nothing rendered against the production font pack.
Permitted next step: open a PR. Do not merge.
Do not decide without me: whether to drop the legacy A4 layout.

Six lines a session is the difference between a covering engineer who can act and one who waits for you to land.

The interrupt threshold

Decide before you go what justifies a message to someone on a plane, and put it in that comment.

Automations do the routing. Of the ten triggers, four are time driven: issue.due_soon, issue.overdue, sprint.started and sprint.ended. The one that matters is issue.overdue, with a condition that the assignee is your agent and an action reassigning the ticket to your covering engineer. That turns the silent failure at the top of this post into a ticket in a present human's digest.

flowchart LR
  A["Agent held ticket passes its due date"] --> B["Rule fires on issue.overdue"]
  B --> C{"Assignee is the agent?"}
  C -->|"No"| D["Nothing happens"]
  C -->|"Yes"| E["Assign to the covering engineer"]
  E --> F["Comment naming the absent owner"]
  F --> G["Ticket enters a human daily digest"]

Two honest limits. Rules carry no date window, so you enable this before you leave and disable it on return. And rules cap at two on Free, which one leave plan consumes entirely, against twenty on Pro. Setup: how to set up automations.

For the threshold, borrow the number incident.io cites from the Google SRE Workbook: no more than two or three actionable incidents per shift. If your rules would reach someone more often, the threshold is wrong, not the person. Taskfolk has no paging, so this stays a team agreement: decision rights between your team and your AI agents.

Coverage costs something too. A viewer is free, but a covering engineer who reassigns tickets and cancels sessions needs an editor seat: $3 a month on Pro, $6 on Business. Changing an agent's field policy is limited to its owner, or to anyone with the owner or admin role, so a stand in needs that role: how to manage roles and permissions.

The undo list for the Monday you are back

Everything you switched on by hand switches off by hand. Write the list before you leave, or you will find it in September.

Turn off the escalation rule. Restore each agent's field policy, because a narrowed allowlist stays invisible until the agent starts failing writes it used to make. Delete the temporary views and drop the watchers.

Then check pending sessions: any delegation nobody claimed for seven days was cancelled while you were away, and those restart first. For the steady state, how to manage a team of AI agents covers the rest.

The one piece I would keep permanently is the second owner per session. Doing it only for holidays leaves it cold exactly when you need it warm.

Open your sessions list, pick the one you would least like to explain to a colleague, and write that comment on it. If human in the loop approval for AI agents is already wired in, that ticket is the one your covering engineer reaches first.