Governance guide

Human-in-the-loop AI workflows: put approval where it matters.

Human approval is useful only when it is specific. A good workflow defines what the system may prepare, what evidence it must show and which exact action still belongs to a person.

Approval is not a vague safety promise

A message that says 'please review' at the end of an opaque process does not create meaningful control. The reviewer needs to know what changed, which sources were used, what remains uncertain and what will happen after approval.

The approval should be attributable, time-stamped and tied to the exact version of the proposed action.

Good places to stop

  • Before sending an external message or publishing content.
  • Before spending money, issuing an invoice or changing a financial state.
  • Before granting access, connecting an account or exposing private data.
  • Before changing rights, contractual terms or authoritative records.
  • Whenever evidence conflicts or confidence falls below a defined threshold.

What the human should receive

  • A plain-language summary of the proposed action.
  • The source evidence and its freshness.
  • Known gaps, conflicts and assumptions.
  • The consequence of approving, rejecting or deferring.
  • A reliable way to reverse or correct the action where possible.

Do not put a person in every step

If every routine action requires a click, the workflow has shifted labour rather than removed it. Deterministic, low-risk steps should proceed automatically once their conditions are satisfied.

Human attention should be reserved for exceptions, material decisions and actions whose consequences cannot be safely inferred or reversed.

Practical questions

Frequently asked

Does human-in-the-loop mean the AI cannot act?

No. It can perform approved low-risk work and prepare higher-risk actions. The boundary is based on consequence, authority and reversibility.

Who should approve?

The named owner of the underlying business decision, not merely the person operating the software.

How many approval gates are enough?

Use the fewest gates that protect material decisions. Too many gates create fatigue; too few hide risk.