A finance operations team lets an agent process invoices with read, draft, and refund tools: low-risk reads can run freely, but any refund call above $500 must pause for controller approval with full context. Which escalation design best configures tool-based human review for this invoice agent?

The correct design implements selective tool-based human review where the high-stakes refund tool pauses execution and escalates to the controller with full invoice context, preserving autonomous operation for low-risk reads while enforcing prior authorization for financial impact. The higher-threshold design that only escalates refunds above $5000 fails on calibration because it correctly uses pausing and context but violates the explicit $500 risk tolerance, allowing in-policy refunds to execute without required oversight. The approve-everything design that escalates reads, drafts, and refunds fails on selectivity because although it provides context and control, it contradicts the requirement that low-risk reads run freely and creates alert fatigue and latency that undermines agent autonomy. The amount-only design that pauses refunds above $500 but omits invoice history fails on context completeness because approval without supporting details prevents informed controller judgment and does not satisfy the full-context mandate. As an exam caveat, distinguish preventive pre-execution approval from detective post-execution logging, since summaries and audits never substitute for a pause when the stem requires pausing. As a practical check, verify in configuration that the escalation rule matches on tool name equals refund and amount greater than 500, blocks tool execution pending decision, and attaches invoice ID, history, and justification to the approval request.