Human in the Loop

Human in the loop means a named person checks an automated step at a set point before the result goes out or changes a record. The person might approve a drafted email, confirm a refund, review a claim appeal, or correct a data match. The automation does the gathering and drafting. The person makes the call that carries risk.

Where the check sits

matters more than whether one exists. A check before a message is sent stops a bad message. A check after the fact only finds it. Good designs put the review where a mistake would be costly or hard to undo: payments, clinical or legal statements, deletions, and anything sent to a customer for the first time.

Review fatigue

is the common failure. If a person approves hundreds of near-identical items a day, approvals become a click without reading. Designs should show the reviewer only what changed, highlight low-confidence items, and send routine, well-tested items straight through once the error rate is known to be low.

Frameworks agree on the principle

The NIST AI Risk Management Framework asks organizations to define human oversight roles and responsibilities. OWASP's guidance on excessive agency lists requiring human approval for high-impact actions as a key control. Neither gives a fixed rule for which steps need a person; that depends on the task and the harm a mistake could cause.

In our builds

we write down every step, mark which ones an agent may do alone and which need approval, and log who approved what and when. The approval step is part of the workflow itself, so it cannot be skipped by accident. As results come in, we move steps from reviewed to automatic only when the numbers support it, and we keep a single off switch that pauses the whole system.