Human in the Loop (HITL)

Definition

Human in the loop (HITL) is a design pattern in which an AI agent gathers evidence and proposes an action, but a person authorises it before it takes effect.

The useful framing is not “how much do we trust the agent?” It is: which specific actions require a signature?

Autonomy is per action

The most common design error is setting one autonomy level for an entire agent. That produces one of two bad outcomes: something dangerous, or something so constrained it saves nobody any time.

A single agent can reasonably be:

• Autonomous on reads. Looking up an order, checking stock, retrieving a policy. No gate.
• Semi-autonomous on low-value writes. Tagging a ticket, updating a note, drafting a reply for send. Gate by exception or sample.
• Gated on anything that moves money. Refunds, price changes, purchase orders, credit adjustments. Always a signature.

The dividing line is blast radius, not confidence score.

What a gate is actually for

A good gate is not a rubber stamp on a model output. It exists so a person makes the decision with the agent’s work in front of them: the order history, the delivery scans, the prior claims, the policy clause. The agent’s job is to make the decision cheap to make correctly — not to make it for someone.

That reframing matters for measurement. If reviewers approve 99% of proposals in under three seconds, the gate is theatre. Either the action did not need a gate, or the evidence is not being read.

How gates fail

• Approval fatigue. Volume outstrips reviewer attention and the gate degrades into a click. Fix by narrowing what is gated, not by adding reviewers.
• The gate is downstream of the write. If the agent has already mutated state and the human is approving a notification, there is no gate. Authorization must be evaluated before the effect.
• No audit trail. A gate with no record of who approved what, on what evidence, is unusable in an incident review or an audit.
• Gating the wrong thing. Teams often gate the visible action and leave a broad, generic write tool ungated beside it.

Where it lives technically

HITL is an authorization and workflow concern, not a prompt concern. On AWS, the enforcement point is Bedrock AgentCore Gateway with Cedar-based fine-grained access control on writes — a policy decision made outside the model. A model can be argued out of an instruction. It cannot be argued out of a policy.

Related terms

AI agent · Tool catalog · Agent evals · Amazon Bedrock AgentCore