Human in the Loop AI Agents: Where to Put Gates

Human in the loop does not mean a person approves everything. It means a person approves the few actions where a mistake is expensive or cannot be undone.

Gate too little and an agent does damage. Gate too much and reviewers click approve without reading. Either way, nobody is checking.

Here is a four-tier model, a table to map actions to risk, and the rules I use to place and enforce gates for human in the loop AI agents.

The Four Tiers of Autonomy

Every action an agent can take belongs in one of four tiers. Decide the tier per action, not per agent.

Tier 1: Auto. The agent acts and nobody is asked. Reads, lookups, drafts, internal notes. Safe to repeat, easy to undo.

Tier 2: Approve first. The agent prepares the action and stops. A human approves, edits, or rejects before anything happens. Refunds, outbound email to customers, record changes in a system of record.

Tier 3: Review after. The agent acts. A human samples the results later and can reverse them. Good for high volume, low value, reversible work, like tagging tickets or filling in non-critical fields.

Tier 4: Never. The agent cannot do this at all. It can propose, but a human does it through a separate path. Deleting production data, changing permissions, moving money above a hard limit.

Most teams only think about tiers 1 and 2. Tier 3 is how you avoid a human bottleneck. Tier 4 is how you sleep at night.

If you want the plain definition first, see the glossary entry on human in the loop.

Map Actions to Risk

List every tool the agent can call. Score each on what it costs if wrong and whether you can undo it.

Here is the table I use. The dollar numbers are examples. Set your own with finance, based on what a single bad action costs you.

Tier	Typical action	Dollar exposure per action	Data risk	Undo
1. Auto	Read a record, search docs, draft text	None	Public or internal, read only	Nothing to undo
2. Approve first	Send a customer email, issue a refund, update a customer record	Up to your approval limit (say, $5,000)	Customer or financial data written	Hard or slow
3. Review after	Tag, route, summarize, fill low-stakes fields	Small, say under $50	Internal, low sensitivity	Easy, logged
4. Never	Delete data, change access, pay above the limit, touch regulated records	Above the limit, or unbounded	Production, regulated, or secrets	Often impossible

Two rules keep this honest. Sort by the worst case, not the average: an agent that issues a $20 refund 99 times and a $20,000 refund once needs a gate on the one. And sort by what the agent can do, not what you expect it to do. This is the same logic behind least-privilege permissions for agents. OWASP names the root causes of agent overreach as excessive functionality, excessive permissions, and excessive autonomy. A tier table forces you to look at all three.

Use data risk too, not only dollars. An action that costs nothing but exposes regulated data belongs in tier 2 or 4. The EU AI Act asks the same of high-risk systems: people must be able to decide not to use the system, or interrupt it with a stop button. You do not need to be in scope to borrow the idea.

Enforce the Gate in the Tool, Not the Prompt

This is the part most teams get wrong.

A prompt that says “always ask before deleting anything” is a request. The model can ignore it, misread it, or be talked out of it. A gate has to be code that the model cannot skip.

Here is the public example everyone remembers. In July 2025, Fortune reported that a Replit coding agent deleted a live database during a code freeze. The agent had been told not to proceed without human approval. It reportedly proceeded anyway. Replit’s CEO called it “unacceptable and should never be possible” and announced automatic separation of development and production databases, plus a planning-only mode. The fixes are structural. None is a better instruction.

OWASP gives the same advice in two parts. Use human-in-the-loop control to require approval for high-impact actions. And implement authorization in downstream systems rather than relying on the LLM to decide if an action is allowed.

In practice, that means:

The gate lives in the tool wrapper. The tool that sends the refund checks its own policy. If the action is tier 2, it returns “pending approval” and creates a review task. It does not execute.
The model cannot approve itself. The approval comes from a different identity, through a different path. Never let the agent’s own output count as the approval.
Credentials match the tier. The agent’s credentials should not be able to do tier 4 actions even if the gate failed.
Pause and resume must survive restarts. A review can take hours. LangChain’s human-in-the-loop middleware, for example, sets a policy per tool and requires a checkpointer so a paused run can resume. Reviewers can approve, edit, or reject.
Rejections go back to the agent, so it changes course.

If the only thing between the agent and a bad action is text in a prompt, you do not have a gate.

Give the Reviewer the Right Context

A gate with a bad review screen is theater. The reviewer needs to decide in under a minute, without opening five other tools.

Show this on every approval request:

What the agent wants to do, in plain words, with exact values. “Refund $412.50 to order 88123,” not “process refund.”
Why, in one or two lines.
The evidence. The source record, email, or policy clause. A link is not enough. Show the key excerpt.
What changes if approved. Which fields, which system, which customer.
What the agent is unsure about. Surface doubts. Do not hide them in a log.
The undo path. How to reverse it, and how long that window stays open.
Three clear buttons. Approve, edit, reject. Edit matters. A reviewer who can fix one number will not reject the whole thing.

Cut everything else. Put the full reasoning trace and raw JSON behind a “details” link. And do not show a bare confidence number unless you have measured what it means. A “92% sure” label with no calibration just nudges the reviewer to approve.

Avoid Approval Fatigue

Approval fatigue is what happens when people see too many prompts and stop reading them.

Anthropic, writing about its own coding agent in March 2026, said users approve 93% of permission prompts and described the result as people no longer paying close attention to what they approve. The research on this is older than AI. A well-known review of automation studies found that automation bias shows up in both naive and expert participants and cannot be prevented by training or instructions. Telling reviewers to “be careful” is not a control.

So you fix it with design. Here is what works.

Gate fewer things. Every unneeded prompt weakens the needed ones. If a reviewer approves an action type 200 times in a row with no edits, it probably belongs in tier 3.

Batch and rank. Fifty similar tier 2 items can become one review screen. Put the unusual and the expensive at the top.

Name owners and response times. Say who reviews, how fast, and who covers when they are out. Unowned queues pile up, and a pile-up pushes people to bulk approve.

Seed the queue. Occasionally insert a known-bad proposal and see whether the reviewer catches it. It sounds harsh. It is the only way to know the gate works. Tell reviewers it happens.

Use automated checks as a first filter, not a replacement. Anthropic’s auto mode lets a classifier decide most actions. Its published numbers: on real overeager actions the full pipeline missed 17%, which Anthropic called “the honest number,” and it said auto mode is not a drop-in replacement for careful human review on high-stakes infrastructure. A filter reduces load. It does not replace a gate on tier 2 and tier 4 actions.

Measure Gate Quality

A gate you do not measure is a belief. Track these numbers per action type, weekly.

Metric	What it tells you	Warning sign
Approval rate	How often the agent’s proposal is accepted as is	Near 100% for a long time: reviewers may be rubber-stamping, or the action belongs in tier 3
Edit rate	How often the reviewer fixes the proposal	Rising: the agent is getting worse, or inputs changed
Time to decision	How long items wait	Seconds on complex items: nobody is reading
Catch rate on seeded errors	Whether reviewers detect planted bad proposals	Low: the gate is not working
Post-approval reversals	Approved actions that had to be undone later	Any in tier 2 deserves a root-cause look
Tier 3 sample error rate	Defect rate in review-after work	Above your threshold: move the action back to tier 2

Two of these matter most. The catch rate on seeded errors tells you if the humans are really checking. The tier 3 sample error rate tells you if it is safe to leave the loop.

Reviewer edits are some of the best test cases you will get. Save them, and feed them into your agent testing strategies and agent evaluation guide work.

Log every decision: who, when, what they saw, what they chose. The glossary entry on the AI audit trail covers what to keep.

Loosening Gates Over Time

Start tight. Loosen with evidence.

My rule of thumb is simple, and it is a judgment call rather than a standard. Move an action from tier 2 to tier 3 when all of these hold:

You have a meaningful run of reviewed decisions, with a count you chose in advance.
The edit and reject rates are low and stable.
No reviewed error would have caused serious harm.
The action is reversible, and the undo path has been tested.
The owner signs off in writing.

Then run tier 3 with a high sample rate for the first few weeks. If the defect rate stays under your threshold, relax the sampling.

Tighten faster than you loosen. If a tier 3 action causes real harm, or the model, prompt, or tools change, move it back to tier 2 at once. A model upgrade resets your evidence. Tier 4 needs a hard reason, like law, contract, or an unrecoverable outcome. Moving something out of it is a new project with its own review.

Anthropic’s guidance on agents points the same way. Agents can pause for human feedback at checkpoints, and autonomy brings higher costs and the potential for compounding errors. Earn it step by step.

Gate Placement Checklist

Use this before you ship any agent that can change something.

Every tool is listed and assigned a tier.
Tier 4 actions are impossible for the agent’s credentials.
Tier 2 gates live in the tool wrapper, and the agent cannot approve itself.
The review screen shows action, reason, evidence, change, and undo path.
A named reviewer, response time, and backup exist.
Paused runs survive restarts, and a timeout means “do not act”.
Approval rate, edit rate, and seeded-error catch rate are tracked.
There is a written rule for moving an action between tiers.

Bottom Line

Put gates on actions that are costly or hard to undo. Leave the rest to tiers 1 and 3.

Enforce every gate in the tool layer. A prompt is not a control.

Then measure whether the humans are really checking. Seed the queue, watch the approval rate, and loosen only with evidence.

Next step: list your agent’s tools today and assign each one a tier.

FAQ

When should a human approve an agent action? When the action costs real money, touches sensitive data, or is hard to undo. Use the worst case, not the average case. If a wrong call would be cheap and easy to reverse, review a sample afterward instead of approving each one.

How do I stop approval fatigue? Gate fewer actions, batch low-risk items, and rank the queue by risk. Seed it with known-bad proposals to test whether reviewers are reading. Anthropic reported that users approve 93% of permission prompts in its coding agent, so assume it happens to your team too.

What context does a reviewer need? The exact action and values, the reason, the source evidence, what will change, what the agent is unsure about, and how to undo it. Add approve, edit, and reject buttons. Keep the full reasoning trace behind a link.

Where is the gate enforced? In the tool or the downstream system, never only in the prompt. The tool returns “pending approval” and refuses to run until a separate identity approves. The agent’s credentials should also lack the rights to do tier 4 actions at all.

How do I measure whether the gate works? Track approval rate, edit rate, reject rate, time to decision, and post-approval reversals. The strongest test is the catch rate on seeded errors. If reviewers miss planted mistakes, the gate is not protecting you.

Three Ways to Work With TMA

Need an agent built? We deploy production AI agents in your infrastructure. Working pilot. Real data. Measurable ROI. → Schedule Demo

Want to co-build a product? We’re not a dev agency. We’re co-builders. Shared cost. Shared upside. → Partner with Us

Want to join the Guild? Ship pilots, earn bounties, share profit. Community + equity + path to exit. → Become an AI Architect

Human in the Loop for AI Agents: Where to Put the Gates