Human in the loop means a person approves each action before it happens. Human on the loop means the system acts while a person monitors and can intervene. Human out of the loop means it acts alone. The level should be chosen per action, not per system, and recorded so you can show which one applied.
What does human in the loop mean?
Human in the loop means nothing happens until a person says so. The system prepares an action, shows it, and waits. The person is a gate, not an observer.
That is the right setting for anything you cannot walk back. Paying an invoice. Filing something with a regulator. Deleting a records set. Granting an entitlement. The cost is throughput. An approval queue moves at the speed of the person clearing it, and a queue nobody has time for turns into a rubber stamp, which is worse than having no gate at all, because it manufactures evidence of oversight that did not happen.
The test for in the loop is one question. If the person had refused, would the action have been stopped? If the answer is no, that is not a gate. It is a notification.
What does human on the loop mean?
Human on the loop means the system acts while a person watches and can intervene. The authority to stop it exists, but it is exercised during or after the action rather than before it.
On the loop only works if two conditions hold in reality rather than on a slide. The person can see what the system is doing, at the level of individual actions, and in something close to real time. And the intervention path works: a stop that halts the run, revokes the credential, and leaves the system in a state you can reason about.
The number worth arguing over is time to intervene. If an action's damage is done in two hundred milliseconds and your fastest realistic human response is four minutes, on the loop is a label, not a control. Reversibility is what makes that gap tolerable. Circulating an internal draft, tagging a record, opening a ticket: all reasonable to catch after the fact.
What does human out of the loop mean?
Out of the loop means no person in the path and no person expected to be watching as it runs. It is the correct setting for a large share of what these systems actually do: reading, classifying, extracting, summarising, drafting, retrieving.
When you take the person out, the control does not disappear. It moves. It stops being approval and becomes containment: what this process can reach, which credentials it holds, which systems it can write to, and what happens when its input is hostile. An autonomous step inside a tight boundary is a smaller risk than a supervised step holding production write access.
How does the NCSC frame oversight for agentic AI?
The NCSC does not hand you an autonomy ladder. What it gives you is controls across a lifecycle. Its guidelines for secure AI system development, published with CISA and international partners, are organised as secure design, secure development, secure deployment, and secure operation and maintenance.
Oversight, in that structure, lives mostly in operation and maintenance: monitor the system's behaviour, monitor its inputs, handle updates securely, and feed back what you learn. That is a more useful starting point than a taxonomy, because it tells you what has to exist before any oversight claim can be true. You cannot be on the loop over a system you are not logging.
Where the NCSC publishes on agentic risk specifically, read it directly rather than taking a vendor's summary of it, including mine.
Which level should each type of AI action get?
Sort actions by two things: how hard the action is to reverse, and what it costs if it is wrong. The model's capability is not one of the inputs. A stronger model does not make an irreversible action safer to leave unattended.
A working default:
- In the loop: anything that moves money, changes a person's rights or entitlements, deletes or overwrites data, leaves the organisation under its name, or is filed with a regulator.
- On the loop: reversible internal writes, scheduling, record and ticket updates, code changes that land in a branch rather than in production.
- Out of the loop: read, search, classify, extract, summarise, draft, simulate, and anything confined to a sandbox with no write path out of it.
Do this per action type, not per system. "Our AI has human oversight" is not a statement anyone can audit. "Ledger writes are in the loop, record updates are on the loop, retrieval is out of the loop" is.
How do you evidence that the level you chose was actually applied?
A policy document is not evidence. It states an intention. Evidence is a per-action record, produced by the system at the time it acted, showing which level governed that action, which named identity approved it where approval was required, what the inputs were, what the system did, and what changed as a result. That is what an AI audit trail is for.
The record then has to be hard to edit quietly, because the only version of this that counts is the one an auditor can check without trusting you. In our Open Audit Record, every consequential action is sealed under ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024. An auditor exports a record and verifies it offline with a public key, using tools that are not ours.
That is tamper-evident, not tamper-proof, and the difference is the point. Tamper-proof would be a claim that nobody can alter the record. You should not accept that claim from anyone, including me. Tamper-evident means that if a line is changed, added or removed, verification fails, and it fails in the hands of someone who does not work for us.
What does EU AI Act Article 14 expect of a deployer?
Strictly, Article 14 is not aimed at you as a deployer. It sits among the requirements for high-risk systems and it binds the provider: build the system so natural persons can effectively oversee it, with an interface and measures that let an overseer understand the system's capacities and limits, stay alert to automation bias, interpret its output, disregard or override it, and interrupt or stop it.
The deployer duty is next door, in Article 26. That is where you are required to assign human oversight to specific natural persons who have the competence, training, authority and support to carry it out, and to use the system in line with its instructions for use.
Read together they set a practical bar. The provider has to make oversight possible. You have to name who does it and give them real authority. In the UK, where automated processing makes a decision with legal or similarly significant effect on someone, ICO guidance on automated decision-making and profiling is clear that human involvement has to be meaningful: a reviewer with no realistic power to change the outcome is not oversight. Note also that the timing of the AI Act's high-risk obligations has been subject to proposed amendment, so check the current position rather than a date you read last year.
What does per-action clearance look like in practice?
In SIOS, the clearance level is a property of the action and it is held by the platform, not by the model and not by the prompt. A destructive action defaults to deny. A consequential action waits for a named person, and the identity that cleared it is part of the sealed record. Agents run in a gated sandbox with a defined reach, so an out of the loop step does not acquire a write path unless a named person grants it, and the system is designed to stop actions that would delete or overwrite data before they run rather than reporting them afterwards. That is the practical shape of staged actions.
It runs on hardware the customer owns, offline capable, with no data egress. Sixty-three studios, fourteen production-ready and forty-nine in development, across fifty specialised models. The closed beta is open and one regulated company is onboarding as a design partner.
None of that removes the decision. Somebody in your organisation has to say which actions a machine may take alone, which it may take while watched, and which it may not take at all without a named person agreeing first. What a platform can do is make that decision explicit, enforce it in the path of the action, and leave behind a record that survives being checked by someone else.
Frequently asked questions
Is human on the loop enough for a high-risk AI system?
Sometimes, but not by default. Under the EU AI Act the provider must build the system so a person can oversee and interrupt it, and the deployer must put named, competent people on that oversight. Where a decision has a legal or similarly significant effect on someone, UK data protection law pushes you towards a person in the path.
Who should be named as responsible for an AI agent's actions?
A named individual with the competence and authority to overrule it, not a team inbox and not a job title. The AI Act's deployer obligations require oversight to be assigned to natural persons who have been given training, resources and authority. Name that person per class of action, record the identity in the audit record, and revisit it when people change roles.
Can we mix oversight levels across a single workflow?
Yes, and usually you should. One workflow can read and summarise out of the loop, draft on the loop, and require in the loop approval for the two steps that write to a system of record. What matters is that the level is attached to the action, enforced by the platform, and recorded, so an auditor can see which level governed each step.
How do we prove a person really reviewed an action rather than clicking through?
You cannot prove attention. You can prove opportunity and accountability: what the reviewer was shown, when, how long the record was open, what they were able to change, which identity approved, and the fact that nothing proceeded until they did. Seal that record. Then sample approvals and test whether a refusal actually stops the action.
Does human oversight mean approving every single output?
No. Approving everything is how oversight decays into clicking. Oversight means the level is deliberate and enforced: a gate on consequential actions, monitoring and a working intervention path on the rest, and containment so an autonomous step cannot reach what it should not. Approve what is hard to undo. Watch the rest properly.
Related briefings
Governance, audit and oversight
- Tamper-Evident vs Immutable Log: The Real Difference
- Generative AI Logging Checklist: What UK Firms Record
- AI Audit Logs vs Data Minimisation: Keep Full Prompts?
- AI Incident Response Plan Checklist for UK Organisations
- Keeping Oversight as AI Scales Across a Business
Deploying private AI
- Private AI for Business: What It Is and How It Works
- Offline AI Assistant: What It Can Do for Your Staff
Part of a series of 60 briefings on deploying and governing AI in UK regulated organisations, archived with a DOI at 10.5281/zenodo.22975756.
Evaluating AI for a regulated organisation? Mickai runs on hardware you own, offline. Consequential actions wait for a named person to approve them, and what the AI did is sealed into a signed record an auditor can check without us. Applications for the invitation-only closed beta are open. Apply for the closed beta.
Written by Micky Irons, founder and chief executive of Mickai LTD.
Top comments (0)