I watched an operations lead approve forty agent actions in about four minutes. Tap, tap, tap. Each one a button that said “Approve” next to a one-line summary and nothing else. She was not being careless. She was being human, in front of a queue that punished her for thinking. By the time the agent moved a payment to the wrong counterparty, the approval had already happened, logged, signed, with her name on it. The human-in-the-loop step worked exactly as built. The build was the problem.
This is the thing teams keep getting wrong. They design an agent, suspect it might do something stupid, and reach for a human as the airbag. Put an approval gate in front of the risky action, ship it, and tell the auditors there is a human in the loop. Technically true. Operationally a fiction. You have not added judgment to the system. You have added a person who absorbs blame for decisions they were never given the means to make.
A gate is not a control
Here is the part nobody tells you. A human approval step only adds safety if the human can actually exercise judgment at the moment they are asked. That is a high bar, and most loops fail it before the human even shows up.
Think about what it takes for a person to make a real decision about an agent’s proposed action. They need to know what the agent is about to do, in specific terms, not a summary that launders the detail away. They need to know what it is acting on, the before state, so a diff means something. They need a sense of how sure the agent is and why. They need to know whether the action can be undone if it is wrong. And they need enough time, and few enough of these, that the question lands as a question and not as friction to clear.
Strip any one of those and you do not have a control. You have a ceremony. The operations lead above had a summary and a button. She did not have the diff, the counterparty detail, the confidence, or the time. The system asked her to be accountable for a decision while withholding everything she needed to make it. That is not a safety net. That is a liability transfer with a nice UI.
The two loops
The contrast is sharp enough to draw.
The bad loop asks a human to ratify. The good loop asks a human to judge, and does the legwork first.
In the bad loop, the agent decides, renders a button, and waits. The human is downstream of a decision that has, in every meaningful sense, already been made. Their job is to not get in the way. Approval rate climbs toward a hundred percent, which everyone reads as “the agent is good” when it actually means “the gate is off.”
In the good loop, the machine does the unglamorous preparation that makes judgment possible. It assembles the context a reviewer would otherwise have to dig for. It renders the diff. It states its confidence and the basis for it. It flags whether the step is reversible. Then it asks. The human is not ratifying a decision. They are making one, with the machine having cleared the desk in front of them. The decision, and what was on screen when it was made, gets logged as a unit. (If your audit trail records the click but not the context the human saw, you are recording theater, not accountability.)
The difference is not the presence of a human. Both loops have one. The difference is whether the architecture put the human in a position to add anything.
Reversible and irreversible are different problems
The single highest-value design move I know is to stop treating every action as needing the same gate. Most do not need a gate at all.
If an action is cheap to undo, let the agent take it and make the reversal one click away. Drafting a message, tagging a record, proposing a categorization: act first, surface it, allow a fast correction. A human reviewing every reversible action is wasted judgment, and worse, it is the thing that trains the reflex of approving without looking. Alert fatigue is not a discipline problem. It is what a well-functioning brain does when ninety-nine of a hundred alerts were safe to ignore. You manufacture it by gating things that did not need gating, and then it bleeds into the one decision that mattered.
Irreversible actions are the opposite. Moving money, deleting the source of truth, sending something to a regulator, anything you cannot take back. Those deserve a real stop, the full context, sometimes a second human, and an interface that deliberately refuses to be fast. I have built screens that would not let you confirm an irreversible action until the page had been open for a few seconds, because the slowness was the feature. If the reviewer wants to think and the UI lets them rush, the UI is fighting the control it claims to be.
Sort your actions on that axis first. Reversible: act and offer undo. Irreversible: stop, prepare, and slow down on purpose. Almost every loop I have seen in trouble had it backward, gating the cheap stuff into a blur and waving the expensive stuff through on momentum.
Design the loop, then automate around it
The reframe that changes how a team builds: the human-in-the-loop is not the agent’s safety net. It is a first-class part of the system, and it gets designed as deliberately as the retrieval layer or the tool schema. Where does human judgment have the highest marginal value, and how do you get the machine to do everything up to that point so the person spends their attention only on the call that needs a person?
That is a UX question and an architecture question wearing a trench coat, pretending to be a compliance checkbox. The compliance team will accept the checkbox. Your operations lead, four minutes into a queue of forty, will not be protected by it. She will be exposed by it, and so will you, the first time the agent is confidently wrong and her name is on the approval.
A good loop is more work than a button. It means building the diff renderer, the context assembler, the confidence surface, the reversibility classifier, the audit record that captures what the human saw and not just what they clicked. None of that is the agent. All of it is the safety.
So when someone tells me their agent is safe because there is a human in the loop, I have one question. What does the human see, and how long do they have to look at it? If the answer is a summary and a button, there is no loop. There is a person you have positioned to take the fall.
Where, exactly, is the judgment in your loop, and have you given it anything to work with?