"A human reviews the output" is the most common risk mitigation in agent proposals, and the least examined. Whether it works depends on what the human actually sees and whether they can say no cheaply.
Why review fails
- Too much volume. When people approve hundreds of items, they stop reading and start clicking.
- Too little context. A bare "Approve refund of 1,200?" hides the reasoning, evidence, and alternatives.
- No safe default. If rejecting is slower than approving, rejections vanish.
- Unclear ownership. Nobody is accountable for the decision, so nobody reads it carefully.
Make the review a typed object
Each approval request should carry:
- The proposed action in plain language and in exact arguments.
- The evidence: sources the agent used, with links.
- The confidence or risk signal, and what policy triggered the review.
- The alternatives considered, including "do nothing".
- Reversibility: can this be undone, and how?
The reviewer's response is also structured: approve, reject with reason, or edit and approve. Rejections and edits are the highest-quality training and eval data you will ever collect, so store them.
Choose the right review mode
- Approve before acting for irreversible or high-impact steps.
- Review after acting with easy undo for low-risk, high-volume work.
- Sample audit for routine tasks, to estimate error rates.
- Exception only where the agent escalates when uncertain or out of policy.
Pick per action class, not per agent. The same agent can auto-update a tag and require sign-off to close an account.
Measure the humans too
Track approval rate, time-to-decision, and edit rate. A ninety-nine percent approval rate with a four-second median decision time is a signal that review has become ritual, either tighten the trigger or accept that the action does not need review.
The goal
Not "a human is in the loop", but "the right human, with the right information, at the right moment, with an easy way to say no."