AINEWS
The agent that asks before it acts: datasette-agent 0.2a0 and the suspended turn
Datasette's new agent can stop mid task to ask you a question, remember your answer after a server restart, and won't save a query until you say yes.
Datasette's new agent can stop mid task to ask you a question, remember your answer after a server restart, and won't save a query until you say yes.
The 0.2a0 alpha is best read as a design pattern, not a product update. Any team wiring LLM agents to real tools eventually has to solve the same problem: the agent is blocked waiting for a human, and the framework has to decide what "waiting" actually means. Datasette's answer, summarized on Simon Willison's weblog on 10 June 2026, has a specific shape. A tool can pause mid-execution to ask a question, the pause persists to disk so the turn survives a server restart, and a write action won't fire until a human has explicitly said yes.
The release introduces two pieces working together. The first is a mid-execution question: tools now receive a ToolContext object and can call context.ask_user() to pose yes/no, multiple-choice, or free-text prompts. The second is durability. An unanswered question suspends the agent turn, the pending question renders as a form in the chat UI, and the suspended state persists to the internal database, so the conversation survives a server restart. Once the user answers, the tool re-executes from the top with stored answers replayed. The release notes warn callers to invoke ask_user() before performing side effects, because re-execution means any non-idempotent work outside that boundary runs twice.
The second piece, save_query, is where the safety gate gets concrete. The tool lets the agent persist SQL it wrote as a Datasette stored query, but the write is always human-approved: the user sees the full SQL, the proposed name, the target database, and the visibility setting before Yes is accepted. This is the human-in-the-loop pattern reduced to a template, one that any agent toolkit can copy: render the proposed action in full, require an explicit human yes, and only then commit.
Both pieces depend on a new LLM alpha built by Simon Willison with the help of Claude Fable 5, which the excerpt doesn't describe, and that detail matters. The design pattern is real, but the underlying model is still moving. The release is also an alpha, versioned 0.2a0, and upstream issue #20 is referenced for both the ask_user workflow and save_query.
The known friction is real. Long-lived suspended turns invite abandoned sessions, and any pattern that lets a user supply free-text answers during tool execution is a prompt-injection surface: the user's reply becomes part of the next tool call, and a malicious prompt embedded in that reply can steer the agent. A team adopting this pattern inherits both costs, and the design has to account for timeouts, replay idempotency, and the trust boundary between user input and tool arguments.
What to watch next: whether the ask_user API stabilizes out of alpha without losing the suspended-turn persistence, and whether the explicit-approval pattern spreads to other write actions in the toolkit, or stays a single-tool property. The pattern is portable even if the alpha isn't, and that portability is the point.