An agent has drafted a supplier payment from an invoice. The amount looks right. The bank details have changed, and the agent has the access needed to release it.
Human-in-the-loop AI means a named person approves consequential actions before the system carries them out. The reviewer sees the proposed action and enough supporting information to decide. For this payment, the money stays put until an authorised person approves the exact proposal.
That's the boundary I'd want to establish before giving an agent access to a business system.
Human-in-the-loop AI: in the loop, on the loop, out of the loop
In the loop means a person makes the decision at a defined point. An agent prepares a customer refund, software checks it against policy, and an authorised manager approves it before payment. Our glossary explains human in the loop.
On the loop means a person supervises work that can proceed within agreed limits. For example, you might allow an agent to categorise incoming enquiries while a supervisor monitors exceptions and can suspend the workflow. That arrangement needs a clear way to intervene.
Out of the loop means no person reviews or intervenes during that task. You might choose this for an overnight internal summary generated from permitted records. Keep its access read-only and prevent the summary from triggering a separate business action without the controls that action requires.
What actually needs approval
I'd use these starting boundaries, then adjust them with the people who own the process.
Swipe or scroll horizontally to compare every column.
| Action | Risk | Approval |
|---|---|---|
| Read data | Exposure of confidential or personal information | Approve the permitted sources and scope first; escalate requests outside them. |
| Summarise or draft | Incorrect content being treated as an accepted decision | Permit internal preparation within scope; review before consequential use. |
| Update a record | Wrong fields or changes affecting another workflow | Allow only explicitly bounded routine changes; require the record owner's approval for consequential updates. |
| Send a message to a customer | Disclosure or an unintended commitment | Require the authorised customer-facing person's approval of generated messages; separately define any permitted fixed acknowledgements. |
| Move money or change access | Financial loss or unauthorised privileges | Require the named payment or access approver before execution; preserve existing dual-approval requirements. |
Decide by consequence and reversibility: a spelling correction and a change to payment details deserve different approval boundaries. Consider what else the change triggers and whether you could recover after an error. How smart the model appears shouldn't determine its authority.
Approval is an identity problem
My background in identity and privileged access security shapes how I look at agents. I start with the account behind the action and the authority that account has. Privileged access means permission to perform sensitive operations, such as releasing a payment or granting administrator rights.
Treat agents as non-human identities: software acting through an account or credential. Give each one an accountable owner and a defined purpose. You should be able to identify which agent requested a change and disable its access when that purpose ends.
Apply least privilege, meaning only the permissions needed for the assigned work. An agent preparing invoices should have narrowly scoped tools for that task. It shouldn't inherit permission to release payments because a convenient integration account already has it. OWASP's guidance on excessive agency recommends minimum permissions and human approval before high-impact actions.
An API key is a credential software uses to access a service. A service account is an account used by software. Neither can approve on a person's behalf, and another agent must never supply the human sign-off.
AI agent approval requires a named person authenticated through your organisation's identity system. Check that they still hold the authority for that particular action. An agent assessing another agent's proposal may contribute a check, but the approval must remain with the authorised human.
Choose the approver by responsibility for the consequence. Route the supplier payment to someone with payment authority. Route a permissions change to the designated access owner under your existing access policy.
The CISO can help define the control without becoming the approver for every operational decision. Where your process separates the requester from the approver, keep that separation. Define authorised cover for absences; a timeout should leave the action pending or escalate it.
Show the reviewer the exact change and its source evidence. For the supplier payment, include the invoice and the changed bank details alongside the validation results. Give the person a practical way to reject the request or ask for more information.
Record who approved which version, when they decided and what the connected system actually did. Bind approval to that proposal: changing the payee or amount should require a fresh decision. Protect the record with access and retention rules appropriate to its contents.
I want AI agent governance to answer a specific question: which person authorised this action? That is the discipline behind our AI agent security and governance work within AI Engineering.
How this works inside an AI harness
An AI harness is the software around the model that manages the task and controls its actions. It connects the approved tools and keeps track of work. The harness enforces the approval point before execution; telling the model to ask permission is insufficient.
The five Ryzolv Harness Rules are:
- The AI proposes, software validates, a human decides.
- The AI never produces a number on its own.
- The AI sees only what it needs.
- Every step is on the record.
- Only a named human can approve.
For the payment example, the harness should hold the validated proposal for review, then check the approval against the exact payment before releasing it. If the proposal changes, the earlier approval no longer authorises it.
When building AI agents, test that boundary directly. Try executing without approval and using an approval for a changed proposal. Both requests should stop before they reach the payment system.
A note for Canadian organisations
Canadian guidance addresses oversight in different ways. OSFI's revised Guideline E-23, effective 1 May 2027 for federally regulated financial institutions, sets expectations for model governance, independent review and model approval. Ontario's Responsible Use of Artificial Intelligence Directive, which applies to Ontario ministries and provincial agencies, explicitly calls for ongoing human oversight. Model approval and oversight are broader than approving each agent action. Applicability depends on your organisation and use case; this is not legal advice.
Questions people ask
Is human-in-the-loop the same as human oversight?
Human oversight covers how people supervise an AI system, including monitoring and deciding when to stop it. Human-in-the-loop approval puts a person at a specific decision point before an action proceeds. A dashboard alone doesn't provide that approval.
Does every AI action need approval?
No. Reading permitted records or preparing an internal draft can operate within previously approved boundaries. Require a fresh decision where the consequence, sensitivity or difficulty of reversal warrants one, and document those boundaries.
Who should the approver be?
A named person with authority over the action and enough knowledge to judge it. That might be the authorised payment approver or the owner responsible for granting access. Give them the supporting evidence and an authorised deputy for absences.
Doesn't approval slow everything down?
It adds a deliberate pause where a decision matters. Keep routine preparation moving and bring the reviewer a complete proposal with the relevant checks. If the queue becomes unmanageable, review the boundaries and staffing before allowing pending actions to proceed automatically.
This week, list the actions your agents can take. Mark which need a named approver and put a person's name beside each one. Review any gaps with the process owner before expanding access.
For help reviewing the controls around your workflow, discuss your AI Engineering project with Ryzolv.
Written by Anshul Kaushik, Managing Director at Ryzolv.
Back to Insights