When do humans actually belong in the loop?

Avoiding performative human-in-the-loop controls

An approval that cannot stop the action is not a control. It is a notification with a job title.

Picture the workflow. An AI agent opens a connection to your production database and runs a DELETE. Slack lights up: "Agent requested DB write. Approve?" Someone taps approve 90 seconds later. The rows disappeared 89 seconds ago.

Nobody set out to build that. It is what you get when oversight lives next to the action instead of in front of it.

Why it matters. Every AI risk conversation ends with the same four words: human in the loop. CIO reported this week that most of those loops do not hold. Reviewers can see a decision and raise a concern. They cannot stop it. Cloudflare's Doug Shepherd calls the result "performative governance." It clears the security review. It does not reduce the risk.

Three questions that expose a fake loop

Darren Kimura of AISquared put the test plainly. Ask these about any AI oversight you have shipped:

Can the reviewer stop the action before it takes effect?
Can the reviewer change the output?
Is the override recorded and enforced downstream?

One "no" and you do not have a human in the loop. You have monitoring with a person attached.

Human adjacent to the loop	Human in the loop
Alert fires after the action runs	Action blocks until someone decides
Approval lives in a chat message	Approval lives in the connection Continue reading? Get the full guide. Human-in-the-Loop Approvals: Architecture Patterns & Best Practices Free. No spam. Unsubscribe anytime.
Log shows that someone clicked approve	Record shows what was requested, what was seen, what ran
Reviewer can escalate a concern	Reviewer can deny, and the deny holds
The agent can find another path	Every path runs through the same gate

The 95% problem

Say your reviewer is qualified, senior, and holds real authority. The loop still degrades.

Eric Billingsley of TrustScale describes the failure well: when a system is right 95% of the time, the reviewer's job becomes waiting for the rare miss. People are bad at that. Akamai CTO Robert Blumofe makes the same point about LLMs. They are correct often enough to earn trust they have not earned, and review turns into reflex.

Run the math on your own setup. A reviewer who sees 400 agent actions a week and finds 397 of them fine is not reviewing by week three. They are clicking.

The fix is counterintuitive: send humans less, not more. Deterministic policy should absorb the boring 95%. Masking should make read-only work safe enough that nobody needs to look. A human should only appear where judgment changes the outcome.

Put the loop in the path, not beside it

Here is the part most AI governance projects skip. Oversight is only real if it sits where the action happens.

If your approval lives in a chat app, a ticket queue, or an agent framework's own config, it is a suggestion. The agent still holds a credential. It still has a route to the database. Deny the request and the query runs anyway, because nothing between the agent and the data was ever listening.

Move the gate to the protocol layer and the physics change. Every connection from every identity, whether that is a human engineer, an AI agent, a vendor, or a cron job, runs through one path. The approval becomes the gate. Deny means the query never reaches the database. There is no second door, so the agent cannot route around the control by picking a different tool.

That placement also fixes the evidence problem. Billingsley is right that a log of someone clicking approve proves nothing. You need proof the reviewer had context and authority. A recorded session gives you that: the exact command requested, the masked output the reviewer saw, the decision, and what actually executed. That is an audit artifact. A Slack thread is not.

Not every decision deserves a human

The goal is not a person in front of every action. Kimura's example is a compromised endpoint. Waiting 20 minutes for an approval lets the attack spread.

Infrastructure access works the same way. A read against a table where PII is masked at the protocol layer should never page anyone. A schema change on the billing database at 2am should stop and wait. Sort your agent actions by blast radius, then gate the top slice and automate the rest. Approvals you use sparingly stay meaningful.

Run the test

Pick your riskiest AI agent workflow. Have someone deny it.

If the action still happened, you do not have a human in the loop. You have a human watching one.

hoop.dev puts the gate in the connection itself. Every identity, human or agent, runs through one audited path with just-in-time approvals, masking, and session-level evidence. See how it works.