Human-in-the-loop is one of the most common AI governance controls, but it is often poorly defined. A human somewhere near the workflow is not enough. The control works only when a person can understand the agent's recommendation, intervene before harm occurs, and create a record of the decision.
For AI agents, human oversight should be designed around actions, not general comfort.
Define the decision point
Start by identifying which actions require human approval. Sending an external message, changing a customer record, issuing a refund, approving a claim, escalating a legal matter, or executing code may need review. Low-risk actions may not.
The control should specify whether review happens before the action, after the action, or by sampling. For sensitive actions, review after the fact may be monitoring, not oversight.
Give reviewers context
A reviewer needs more than the agent's final output. They should see the source information, relevant policy, confidence or uncertainty signals, tool calls, retrieved documents, and the reason the agent proposed the action. Without context, the reviewer may simply rubber-stamp the system.
Human review should reduce risk, not transfer blame to a person who cannot reasonably evaluate the output.
Make authority real
The reviewer must be able to approve, reject, edit, escalate, or ask for more information. If the workflow pressures the reviewer to approve quickly or hides the alternative path, the control is weak.
For high-volume workflows, consider risk-based routing. Low-risk items can use sampling or automated checks. High-risk items should receive deliberate review.
Keep evidence
Human oversight should leave evidence: reviewer identity, timestamp, decision, rationale, edits, escalation, and related agent output. This evidence is useful for audits, incident review, training, and control improvement.
Review the control itself
Monitor approval rates, override rates, reviewer disagreement, incidents, time pressure, and repeated failure patterns. If reviewers approve everything, the control may be ceremonial. If reviewers override often, the agent or policy may need improvement.
Human-in-the-loop is not a slogan. It is a designed control with a specific decision, capable reviewer, meaningful authority, and durable proof.