The architecture for deciding when agents act autonomously and when they pause for human review.
Human-in-the-loop (HITL) is not a limitation imposed on AI systems — it is a safety architecture designed into them. HITL defines the checkpoints at which human judgement is required before an agent can proceed, and the interfaces that make that judgement efficient and meaningful.
HITL design starts with a decision taxonomy: for each decision the agent system makes, what is the consequence of an error, what is the frequency, and what is the human reviewer's capacity? High-consequence, low-frequency decisions (e.g. approving a contract amendment above £100k) warrant mandatory human review. Low-consequence, high-frequency decisions (e.g. categorising a support ticket) can run autonomously with periodic sampling. HITL interfaces must be designed to enable meaningful review — not just click-through approval. The reviewer needs the right information, presented clearly, to make a genuine decision rather than simply ratifying what the agent has already effectively decided.
A mortgage processing firm implements a tiered HITL architecture. Applications below £250k with clean credit histories are processed autonomously with 5% random sampling for quality review. Applications above £250k or with any anomaly flags are routed to an underwriter for review. All declined applications — regardless of value — require a human to confirm the decline before the decision is communicated. The review interface shows the agent's reasoning, the specific data points that triggered the decision, and a comparison against recent similar applications. Average human review time is 4 minutes per flagged application.
Regulatory frameworks increasingly require human oversight for high-stakes AI decisions. But beyond compliance, HITL is sound risk management: it ensures that the consequences of agent errors are bounded, that humans remain meaningfully in control of consequential decisions, and that there is a human accountable for outcomes that matter. The absence of HITL in high-stakes workflows is one of the most common findings in production AI audits.
How this pattern fails in practice - and what to watch for.
The volume of agent outputs routed to human review exceeds reviewer capacity. A backlog builds. Agents queue their outputs waiting for approval. The business process the AI was meant to accelerate becomes slower than the manual process it replaced.
Reviewers receive hundreds of approvals per day. After the first few, they stop reading and start approving. The HITL checkpoint has become a formality. In an audit, the organisation can demonstrate a HITL architecture — but not that the human review was meaningful.
Under pressure to accelerate processing, the HITL thresholds are gradually raised and the review interface is made simpler. Over 18 months, what began as a meaningful oversight mechanism becomes a rarely-triggered formality that no one remembers the original purpose of.
Seven things to verify before deploying this pattern in production.
Use the checklist and failure modes above as review prompts. Record the evidence that each mapped PSF domain and PAI-8 control is operating, name the owner for unresolved gaps, and set a date to review the pattern again after material system changes.
Use this pattern library as an implementation reference for deployment safety, governance, and audit evidence. Pair each pattern with named owners and evidence from the system you are reviewing.