human in the loop

In depth

Where to place the stops

The placement of stopping points follows reversibility, never difficulty. A complicated but cancellable task can be left to run on its own, whereas a trivial and final gesture deserves a confirmation: sending a message to a customer, deleting data, committing a spend, publishing. The right question is therefore not “is the system capable of it” but “what does repair cost if this precise action is wrong”. Three forms coexist: giving approval before the action, checking a sample afterwards, or being called only when the system signals a doubt. The last two cost far less and are enough everywhere the error can be recovered.

Being able to decide

A stopping point is worth something only if the person can really rule. That supposes showing them the exact action and its consequences, and not a reassuring summary produced by the system itself. It also supposes a sustainable rhythm, because beyond a certain number of approvals a day attention collapses and consent becomes a reflex. Finally, refusing must be as simple as accepting, and the refusal must be recorded: it is the most precious signal a team has for correcting its system.

Rubber-stamping

The first trap is complacent approval, when dozens of consents without incident let vigilance drop and the stopping point no longer protects anything except on paper. The second is the asymmetry of responsibility: the system prepares everything, one person alone carries the error of a sequence they did not watch unfold, which is untenable as soon as the pace picks up. The third is the gradual withdrawal of approvals, decided in the name of fluidity, without any decision being traced or any risk revised. A human in the loop is therefore designed as an arrangement to be maintained: measure the rate of refusal, rotate the people, and periodically reopen the question of where the dial sits.