“Human in the loop” is only useful if the loop is designed. Otherwise it becomes a slogan attached to a workflow where people rubber-stamp outputs they cannot evaluate or get interrupted so often that the agent saves no time.
The better question is when the agent should act, when it should ask, when it should escalate, and when it should stop.
The human should enter where judgment changes risk
Do not ask people to approve everything. Ask them to decide where evidence is incomplete, impact is high, reversibility is low, or policy requires authority.
Four modes, not one loop
Human involvement should vary by action type:
- Auto-complete: low-risk, reversible, well-measured actions.
- Human approval: meaningful business action with enough evidence for review.
- Escalation: ambiguous, high-impact, policy-sensitive, or conflict-heavy cases.
- Stop: missing evidence, unsafe request, untrusted instruction, or prohibited action.
The NIST AI RMF encourages teams to manage AI risk across design, development, use, and evaluation. This is what the wait rule does in practical terms. It connects the workflow’s risk to the point where human judgment is needed, then gives operations a way to evaluate whether that gate is working after launch.
The wait-rule artifact
Human-in-the-loop wait rules
Use this artifact to decide where human review belongs before the agent enters production.
Agent condition: Low risk and reversible
- Agent behavior
- Complete the action and log the event
- Human role
- Review samples and monitor metrics after the fact
Agent condition: High value or customer-facing
- Agent behavior
- Prepare a decision packet and wait for approval
- Human role
- Approve, edit, reject, or escalate with recorded rationale
Agent condition: Evidence missing or conflicting
- Agent behavior
- Ask for missing context or route an exception
- Human role
- Resolve the evidence gap or decide whether to proceed
Agent condition: Sensitive data or regulated impact
- Agent behavior
- Apply stricter permission and review requirements
- Human role
- Confirm authority, compliance posture, and audit trail
Agent condition: Unsafe, prohibited, or suspicious instruction
- Agent behavior
- Stop the workflow and flag the run
- Human role
- Investigate, remediate, and decide whether controls need updating
Show reviewers the right context
An approval request should not be a naked generated output. It should show the source records, recommendation, uncertainty, policy reason, proposed action, and rollback path.
flowchart LR
A["Agent prepares work"]
A --> B{"Wait rule"}
B -->|Act| C["Complete and log"]
B -->|Ask| D["Approval packet"]
B -->|Escalate| E["Specialist review"]
B -->|Stop| F["Incident or block"] OWASP’s LLM Top 10 turns “just have a person review it” into a weaker control than many leaders assume. Human review can fail if the workflow passes through prompt-injected content, exposes sensitive data, leaks system prompts, lets generated output become tool instructions without validation, or gives the agent excessive agency. The human loop should be supported by system controls: input trust labels, permission checks, output validation, and denied-action logs.
Improve the loop after launch
Measure approval rate, edit rate, rejection reasons, missed escalations, time-to-review, and downstream defects. If reviewers edit the same issue repeatedly, update the workflow. If the queue becomes a bottleneck, narrow the wait rule. If incidents occur after auto-complete, tighten the gate.
Metacto Continuous AI Operations is where these reviewer signals become evals, monitoring, incident routines, runbook changes, and release decisions. The loop should get sharper over time; Metacto’s schema-drift remediation proof point, fixed in five days, is the kind of operating muscle review data should create.