Human-in-the-loop (HITL)

Why human-in-the-loop matters

It is the pattern that makes AI deployable on work that matters. Fully unattended automation requires confidence you do not have on day one, and waiting until you do means never deploying. Keeping a person on the decision lets you take the productivity gain immediately while the risk stays where it already was.

It also generates the evidence for everything that follows. Every time a reviewer accepts or changes an output, you learn how accurate the system actually is on your real cases. That measurement is the only defensible basis for granting more autonomy later — without it, the decision to go unattended is optimism.

How human-in-the-loop works

In practice it means inserting an approval point and designing for the reviewer rather than the model. Three things decide whether it works.

The output has to arrive ready to approve — a complete draft reply, a populated record — not raw model output the reviewer must interpret. It has to show why, with the source records visible, so the reviewer can check rather than re-do. And rejections must be captured, because a reviewer who silently fixes things teaches the system nothing and hides the error rate.

The failure mode to watch for is rubber-stamping. If approving is one click and reviewing properly takes two minutes, the oversight is nominal.

Human-in-the-loop vs human-on-the-loop

Human-in-the-loop puts a person inside the decision: nothing takes effect until they approve it. Human-on-the-loop puts them outside it: the system acts unattended and a person monitors, spot-checks and can intervene or roll back.

The choice follows reversibility rather than risk appetite. Where an action can be undone cheaply, on-the-loop with a good audit trail is usually the better trade, because in-the-loop review on high volumes becomes its own bottleneck. Where an action cannot be undone — a payment, a contractual commitment, a message to a customer — keep the human in it, permanently.

When you need it

Use it for anything customer-facing, anything financial or contractual, anything irreversible, and anything covered by a regulatory duty. It is also the right default for any new automation regardless of risk, as the stage that produces accuracy evidence.

It does not have to be permanent everywhere. The pattern we use is to promote individual case types to unattended once the reviewer is demonstrably not changing them, while the harder categories stay under review. That is more useful than one global switch, and it keeps guardrails and human judgement working on the cases that actually need them.