Human in the Loop AI: What an Approval Must Show and Log

AI means artificial intelligence. Human in the loop means a person approves or rejects an AI agent's proposed action before it runs. It works as a control only when the system, not the model, shows the exact action, enforces the decision and records what actually ran.

Is a human approval step enough governance?

Not on its own. An approval step is one control among several. The Open Worldwide Application Security Project (OWASP) lists it as one mitigation for excessive agency, its term for agents that can do more than they should:

"Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken."

OWASP, LLM06:2025 Excessive Agency

OWASP pairs it with limiting what agents can do and which permissions they hold. An agent with broad access can still cause damage through actions that never reach a person. Human on the loop is the lighter version: a person monitors the system and can step in, without approving each action.

Field guide. The Field Guide to AI Governance covers effective human oversight and the audit records that make it checkable. Read the field guide.

How do approval steps fail in practice?

Most failures share one cause: the approver decides on a description of the action and never sees the action itself.

• Vague requests. The screen says "update the customer record" and leaves out which fields change.
• Hidden recipients. "Send update to customer" hides the recipient list and the message body.
• Forged dialogs. OWASP describes HITL Dialog Forging, also called Lies-in-the-Loop, in which the approval dialog itself is manipulated. It reports that Checkmarx researchers manipulated the approval dialog in Claude Code and achieved remote code execution that started from a GitHub issue. OWASP
• Approval fatigue. When prompts are frequent and routine, people learn to click yes.

The best primary evidence on fatigue comes from medicine. A study in the Journal of the American Medical Informatics Association (JAMIA) looked at high-priority drug interaction alerts at one academic health center. Of 16,011 alerts shown to clinicians, 15,318 (95.7%) were overridden, including 193 (87.3%) of the highest-severity ones. Edrees et al., JAMIA, June 2020

Clinical alerts, not AI approvals. The pattern is the one to design against.

What must the approver see before clicking approve?

The application builds every item below from the structured tool call and its own records. The model may add a summary, but the summary never replaces them:

• The exact tool or interface being called, with its raw arguments.
• The target system, the records and people affected, and whether the action can be undone.
• The data behind the proposal, with outside or untrusted content clearly marked.
• The identity the action runs under and the permissions it carries.
• The agent's earlier steps in the same task.
• A diff for record changes and a full preview for outbound messages.

The Model Context Protocol (MCP), a common standard for connecting agents to tools, sets a baseline:

"For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations."

Model Context Protocol, Tools specification, 2026-07-28 revision

Reviewing an approval flow that is already in production? Talk to Chiri or see how Chiri Brain handles it.

What must be enforced outside the model?

Anything the model can rewrite, it can be talked into rewriting. Prompt Injection in the Data AI Agents Read explains how. These checks belong in application code and identity systems:

• The gate itself. Policy decides which actions need approval, and the agent cannot skip it.
• Binding. The approved request is the one that runs; if anything changes after approval, the action fails.
• Approver authority. Only the right role can approve, and nobody approves their own request.
• Step-up approval. Payments, external sends, deletions, access changes and production releases need a second approver.

What should the approval log record?

A useful baseline is control AU-3 in the US National Institute of Standards and Technology (NIST) catalogue SP 800-53. It requires audit records to establish six things: what type of event occurred, when, where, its source, its outcome, and the identity of anyone or anything involved. NIST SP 800-53 Rev. 5 For an agent approval, add two more: what the approver was shown, captured as rendered, and what actually ran. If those two records differ, the binding control has failed.

Which actions need approval?

Action	Can it be undone?	Control	What the approver sees
Read internal data within scope	Yes	Automatic, logged	Nothing; reviewed by sampling
Update an internal record	Usually	Single approval	The diff and the identity used
Send a message outside the company	No	Single approval	Full message and every recipient
Move money	No	Step-up approval	Amount, payee, account, raw request
Change access or permissions	Sometimes	Step-up approval	Who gains which access, for how long
High-volume routine decisions	Varies	Human on the loop	Escalation signals, not each case

Keeping approvals rare keeps them meaningful. What Are Agentic Workflows? covers which steps an agent should decide and which should stay fixed rules, and the AI launch approval checklist covers the decision to go live.

How Chiri approaches this. Chiri builds, operates, and improves company-specific software as an AI managed service provider. Small teams of senior operators and engineers work with the customer. Chiri Glacier, part of the platform, checks actions and stops bad ones before they execute, and audit logging records what ran. See Chiri Brain

Designing approval steps people will actually read? Talk to Chiri.

Questions and answers

What is the difference between human in the loop and human on the loop?

Human in the loop means a person approves each proposed action before it runs. Human on the loop means a person monitors the system and can step in without approving each action. Use the first for high-impact actions and the second for high-volume work.

Can an AI agent fake an approval prompt?

Yes. OWASP calls this HITL Dialog Forging, or Lies-in-the-Loop. The defence is to build the approval screen from the structured tool call in application code, never from text the model writes.

Which agent actions should always need approval?

Actions that cannot be undone, leave the company, move money or change access. The highest-impact of these should need a second approver.

What should an approval audit log contain?

The six elements in NIST SP 800-53 control AU-3, plus what the approver was shown and the exact tool call that ran.

How do you prevent approval fatigue?

Ask less often. Let reversible, internal, low-impact actions run automatically with logging, and keep approvals for actions that carry real risk.