Human-in-the-loop is a scheme in which an AI system does not perform an action until a human approves it. For AI agents, it is the most common control method: in 37 of 70 public descriptions of agent deployments in Russia in 2025–2026 (52.9%), the main containment measure is human approval. But under a stream of actions, approval quickly turns into a rubber stamp: the person clicks “Approve” without reading. This is called approval fatigue.
In brief
- Human-in-the-loop: a person approves an AI action before it runs.
- It works while there are few actions. When an agent proposes hundreds of actions an hour, the person’s attention runs out before the stream does.
- Approval without checking is worse than no approval: it creates the appearance of control and shifts responsibility onto whoever clicked the button.
- What to do: the human approves rules, and a program checks every action against them; approval remains for exceptions and high-risk actions.
What is human-in-the-loop?
It is a control method in which a decision or action of an AI system takes effect only after a human approves it. Three levels of involvement are distinguished:
| Level | What the human does | Example |
|---|---|---|
| Human-in-the-loop | Approves every action before it runs | The agent prepares a payment, an accountant clicks “Post” |
| Human-on-the-loop | Watches and can intervene, but does not approve each action | An operator monitors a dashboard and stops the agent when something fails |
| Human-out-of-the-loop | Takes no part in individual actions | The agent acts on its own within set limits |
The EU AI Act requires human oversight for high-risk systems (Article 14) but does not require every action to be approved: oversight measures must be commensurate with the risks, the level of autonomy and the context of use. The people assigned to oversight must understand the system’s capabilities and limitations, remain aware of the tendency to rely automatically on its output (automation bias), and be able to intervene or stop the system.
Why doesn’t approving every action scale?
There are three reasons.
- The stream. An agent acts faster than a person can read. The more approvals per hour, the less time for each one.
- Almost everything is normal. If 99 requests out of 100 are harmless, a person learns to click “Approve” automatically. The hundredth, dangerous one goes through with the same gesture. The tendency to rely automatically on a system’s output is called automation bias; the AI Act explicitly requires the overseeing person to remain aware of it (Article 14(4)(b)).
- The person sees the wrong thing. They see a short description of the action written by the agent itself, not the call parameters. If the agent has been misled by prompt injection, the description will look reasonable.
Something similar has long been known in security operations centres: when there are too many alerts, a significant share of them go unexamined. Tian Pan’s essay “Approval Fatigue” (June 2026) carries this experience over to approvals of AI actions and describes how an approval gate degrades into a formality over time.
What does the human sign off on, if not every action?
Rules. Instead of a hundred identical approvals an hour, the person approves once what the agent may do:
- which tools are available for the task;
- within what limits: amounts, recipients, paths, export volume;
- what is always forbidden, for example deleting backups or paying to new bank details without verification;
- who is responsible for the rule and how it changes.
From then on, a program checks every agent action against the rule: before execution, deterministically, with the decision written to a log. The human reviews refusals and incidents and changes the rules. This is the IS 3.0 architecture; how checking an action differs from filtering text is explained on the page about guardrails.
Where is human approval still needed?
Approval does not disappear; it becomes rare and therefore meaningful:
- irreversible high-risk actions: a large payment, deletion of production data, a mass mailing to customers;
- exceptions: an action the rule does not cover or explicitly forbids, but which the business needs;
- changing the rules themselves, and moving a class of actions from warning mode to enforce mode;
- the agent’s first weeks of work, until statistics have built up for each class of actions.
A good approval request shows the person not the agent’s summary but the call parameters and the reason why the rule did not let the action through automatically.
What to do
- Count the stream. How many approval requests each employee receives per day and how many of them they rejected. If almost none, approval has become a rubber stamp.
- Split actions by risk. Routine ones go under a rule; irreversible and large ones go to approval.
- Write down the rules for routine actions and have management approve them.
- Show the approver the parameters, not the agent’s description.
- Keep a log of both approvals and automatic decisions: you will need it in an incident review and in a dispute over who is liable for an AI mistake.
Frequently asked questions
What is human-in-the-loop in simple terms?
It is a scheme in which an AI system does not perform an action until a human approves it. For example, an agent prepares a payment and an accountant posts it.
What is approval fatigue?
It is a state in which a person who receives many approval requests stops checking them and approves automatically. Approval remains on paper, but control disappears.
Is human-in-the-loop enough for AI agent security?
Only when there are few actions. Under a stream, people stop reading carefully, and what they see is often the agent’s summary rather than the parameters of the action. It is more reliable for the human to approve rules and for every action to be checked against them automatically.
How does human-in-the-loop differ from human-on-the-loop?
In human-in-the-loop, a person approves every action before it runs. In human-on-the-loop, the person watches the system work and can intervene, but does not approve each action.
When is human approval still mandatory?
For irreversible high-risk actions, for exceptions to the rules, for changing the rules themselves, and during the agent’s first weeks of work, until statistics on its actions have built up.
Sources
- Regulation (EU) 2024/1689 (AI Act), Article 14 “Human oversight”, EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Tian Pan, “Approval Fatigue: How Human-in-the-Loop Gates Decay Into Rubber Stamps”, 25 June 2026 (author’s essay): https://tianpan.co/blog/2026-06-25-approval-fatigue-how-human-in-the-loop-gates-decay-into-rubber-stamps
- ANO Scientific Research Institute of System Synthesis: desk review of 70 public descriptions of AI agent deployments in Russia, 2025–2026, October 2026
Checked: 16 October 2026