Human-in-the-loop (HITL) is a design pattern in which a person reviews, approves, or can override an AI system's decisions before or during execution. In agentic systems it typically takes the form of approval gates: the agent prepares an action — a payment, a deletion, an external communication — and a human with appropriate authority confirms or rejects it before it executes. HITL is the control that trades latency for judgment, and it is explicitly required or strongly implied by most AI governance frameworks, including the EU AI Act's human-oversight obligations for high-risk systems.

The pattern sits on a spectrum. In-the-loop: the human approves each gated action before it happens — strongest control, highest friction. On-the-loop: the human monitors and can intervene, but actions proceed by default — appropriate where speed matters and reversal is possible. Post-hoc review: humans audit samples after the fact — an accountability mechanism more than a control. Choosing the right point on this spectrum, per action class rather than per system, is most of HITL design.

What makes an approval gate real

The failure mode of HITL is ritual: a human clicking "approve" without the context or time to judge. A gate is real when four properties hold:

  • Context sufficiency. The reviewer sees what the agent intends to do, with the evidence behind it — the data read, the reasoning trace, the exact parameters of the action — not a yes/no button on a one-line summary.
  • Genuine authority. The reviewer can reject without friction, and rejection has a defined, safe outcome. If declining an approval breaks the workflow, approvals will always be granted.
  • Risk-proportional routing. Only actions whose blast radius justifies human latency get gated — irreversible operations, significant financial consequences, decisions materially affecting individuals, and anomalous or out-of-envelope requests. Gating everything guarantees approval fatigue.
  • An audit record. Who approved what, when, seeing which context — captured in the same tamper-evident log as the agent's actions, because the approval is itself an accountable decision. The design details are covered in human-in-the-loop approvals for high-risk agent actions.

HITL as an attack surface

Because approval gates stand between attackers and high-value actions, they get attacked — a risk category the OWASP Agentic Top 10 recognizes directly (human-agent trust exploitation). The canonical technique is fatigue flooding: a partially compromised agent generates a stream of routine approval requests until reviewers rubber-stamp on autopilot, and the malicious request ships in the noise. Defenses follow from the gate properties above: keep gated actions rare enough that each gets real attention, monitor approval-request patterns as an anomaly signal in their own right, and treat a spike in requests as suspicious rather than merely busy. The full treatment is in the Agentic Top 10 guide.

Where HITL fits in the control stack

HITL is a selective control, not a substitute for the automated layers. Guardrails and continuous authorization handle the volume — evaluating every action at machine speed — while HITL takes the narrow slice where consequences justify human latency. Regulation reflects the same layering: the EU AI Act requires that high-risk systems be designed for effective human oversight, which in practice means the context, authority, and override paths above, not a checkbox in a UI. And for actions gated by HITL, the approval requirement should be enforced at the control plane — an agent that can bypass its own approval gate when manipulated never had one, the placement argument made throughout AI agent runtime security.

Common questions

What is human-in-the-loop in one sentence? A design where a person reviews, approves, or can override an AI system's decisions — typically as approval gates on high-impact agent actions — trading latency for human judgment on the actions that warrant it.

Which actions should require human approval? Actions that are irreversible or hard to reverse, carry significant financial consequences, materially affect individuals' rights or opportunities, touch highly sensitive data, or fall outside the agent's normal behavioral envelope. Everything else should be handled by automated controls — over-gating produces approval fatigue, which defeats the gate.

Does the EU AI Act require human-in-the-loop? The Act requires high-risk AI systems to be designed for effective human oversight, including the ability to understand, monitor, intervene in, and override the system. Approval gates are the most common implementation for agentic actions, but the obligation is the capability and its effectiveness, not one specific UI pattern.

Can attackers exploit approval workflows? Yes — chiefly through fatigue flooding (drowning reviewers in routine requests until approval becomes automatic) and through context manipulation (making a malicious action look routine). Countermeasures: risk-proportional gating, context-rich approval surfaces, and anomaly monitoring on the approval stream itself.