There is a human in the loop. They have 340 items waiting, thirty seconds per decision and no access to the evidence.
Technically, you have oversight. Practically, you have a person paid to click a button.
The short answer: human-in-the-loop AI requires a reviewer with authority, evidence, time and a usable escalation route. Define which actions require approval and what happens when approval does not arrive. A review gate must be capable of stopping the action.
Classify actions by consequence
Separate drafting from sending, recommending from approving, and preparing a transaction from executing it. A system may be allowed to produce a draft while requiring explicit approval for the external action.
Use the consequences of error to set controls. Confidentiality, financial exposure, impact on people and reversibility matter more than how confident the answer sounds. A model’s self-reported confidence is not sufficient authority.
The NIST AI RMF provides a voluntary risk-management reference. The matrix below turns part of the oversight discussion into workflow decisions.
Start with an approval matrix
| Action | Suggested control | Evidence the reviewer needs | If nobody responds |
|---|---|---|---|
| Internal draft | Review proportionate to use | Sources and uncertainty | Retain as draft |
| Customer commitment | Approval before sending | Final text, recipient and obligations | Hold and escalate |
| Financial action | Established financial authority | Amount, beneficiary and independent checks | Do not execute |
| Access change | Authorised system owner | Identity, scope and expiry | Keep current permissions |
| Consequential decision about a person | Relevant accountable specialist | Full case evidence and applicable rules | Escalate through the approved process |
Adapt the categories to your organisation. This table does not authorise a deployment or replace sector-specific requirements.
Make approval specific and short-lived
An approval should refer to the exact proposed action: recipient, content, amount, system and scope as relevant. If the proposal materially changes after review, require a new decision. Do not let approval of one draft become standing permission to send any future version.
Record who approved, what they saw and when the action occurred. Set an expiry where circumstances can change. A reviewer should be able to reject, request revision or escalate without inventing a workaround.
Keep the authority check outside the model’s own text. An instruction saying “ask permission” is weaker than a system that cannot execute without valid approval.
Check whether the queue is physically workable
Use a simple capacity calculation. In an illustrative workflow, 120 reviews a day at three minutes each require six hours of review time before breaks, interruptions or difficult cases. Giving the queue to someone with two spare hours does not create a control.
Measure arrival rate, review duration, age of the oldest item and rework. Assign a deputy and define coverage when the primary reviewer is absent. For UK–UAE operations, make the handoff and working hours explicit.
If demand exceeds capacity, narrow the automation, improve the evidence presented or add review capacity. Do not silently lower scrutiny to make the dashboard green.
Define timeouts and escalation
Specify when an item becomes overdue, who is alerted and what the system does meanwhile. A safe default for an unapproved consequential action is to hold it, not infer consent.
Avoid escalation loops in which each queue forwards to another. Name the final decision authority and the route for urgent incidents. Give reviewers enough context to make a decision without reconstructing a long chat history.
Review the exception rate. A process that escalates almost everything may be poorly designed or simply unsuitable for this degree of automation.
Test whether oversight can fail safely
Send an item to an absent reviewer. Attempt an action after approval expires. Change the destination after approval. Deliver the same event twice. Ask the system to act through an account without the required role.
Verify that the action is blocked or safely handled and that the owner can see what happened. Include rejection and cancellation in tests, not just approval. OWASP’s GenAI work is a useful source for thinking about excessive authority and untrusted instructions.
Good oversight reduces uncertainty before the action. If the reviewer only discovers the details afterwards, the human is in the audit trail, not meaningfully in control.
Sources and scope
Reviewed 1 November 2026. The examples and worksheets are my suggested working methods, not measured client results or official standards.
