A human-in-the-loop control is a gate an action cannot pass without a person's decision recorded against it. The test is narrow and it is mechanical: if the action can complete while the person is asleep, offline or unaware, there is no gate. A dashboard is not a gate. A notification is not a gate. An after the fact review is not a gate. The only thing that qualifies is a condition the action has to satisfy before it takes effect, and that condition is a decision by a named person that something later can check.
What does the control have to do to count?
Four properties, and a control missing any one of them is weaker than it looks.
- It blocks. The action waits. Nothing runs while the decision is open.
- It is decided by a person. Not by a rule that names a person, and not by a system acting on their behalf.
- It shows the actual action. The person sees the operation, the target and the arguments that will run, not a summary generated by the component asking for permission.
- It leaves a record. Who decided, what they decided, on which exact action, at what time.
Compare that with the three things usually shipped instead. Notification tells the person after the effect. Monitoring lets them find it later. Veto windows let the action proceed unless someone objects in time, which converts silence into consent and fails toward action.
Is a person watching the same as a person deciding?
No, and the difference is where most of these controls fail. Oversight literature has been clear about it for four decades. Bainbridge showed that automating a task and leaving the human to monitor it produces the worst division of labour available, because sustained attention to a process that rarely needs intervention is a task people do badly (Bainbridge, 1983). Parasuraman and Manzey reviewed the evidence for automation complacency and automation bias, and found that operators reduce their own monitoring and accept automated recommendations without verifying them, with the effect strongest where the automation is usually right (Parasuraman and Manzey, 2010).
An agent that proposes correctly nine hundred times trains its approvers to approve. That is not a character flaw in the approvers. It is a predictable result of the design, and it means the gate has to be placed where the number of decisions stays small enough to survive attention.
What do the rules actually require?
The EU AI Act requires that high-risk AI systems be designed so they can be effectively overseen by natural persons, and it lists what the overseer must be able to do: to understand the system's capacities and limitations, to remain aware of automation bias, to interpret the output, to "decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the output", and to "intervene in the operation of the high-risk AI system or interrupt the system through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state" (Regulation (EU) 2024/1689, Article 14(4)). Note the scope: those duties attach to high-risk systems as the Act defines them, not to every agent someone deploys.
Two-person confirmation is a much narrower duty than it is usually quoted as being. Article 14(5) requires separate verification by at least two natural persons only for the systems in Annex III point 1(a), remote biometric identification, and it is disapplied in certain law enforcement, migration, border control and asylum uses. The AI Act does not impose a general two-person rule. Article 26(2) puts a different duty on the deployer: human oversight must be assigned to natural persons with the necessary competence, training and authority.
Outside the regulations, OWASP's recommendation for excessive agency is direct: "utilise human-in-the-loop control to require a human to approve high-impact actions" (LLM06:2025). Access enforcement catalogues carry the same idea as a control: NIST SP 800-53 Rev. 5 AC-3(2) is dual authorization, discussed in dual authorization for AI agents.
How is the gate designed in practice?
- Gate on reversibility, not on confidence. Actions you can undo are cheap to get wrong. Actions nobody can take back are the ones worth a person.
- Keep the volume low. The number of gated actions per shift is the budget for real attention. Everything else should be refused or allowed outright.
- Show the bytes that will run. Approving a description is approving the describer.
- Make the decision identity-bound. The check is on the identity that signed the approval, not on a display name in a message.
- Fail toward inaction. An unanswered gate expires and nothing runs. A hold that becomes an allow on timeout is a delay, not a control.
- Separate the proposer from the approver. A component cannot approve what it proposed.
- Put the channel out of band. If the approval arrives through the same system the agent can write into, the agent can fabricate the approval.
Where does it fail?
Rubber stamping under volume. Approving a summary the compromised agent wrote. One approver with two accounts. An approval channel the agent can post to. A gate on the API while a second path to the same system stays open. A gate at the user interface rather than at the point of effect, which a direct call bypasses. And the broadest failure: gating everything, which produces a queue nobody reads and a business case to switch the gate off. Defence layers generally are compared in prompt injection defences and their limits.
How does ZIFFER hold an action for a person?
In ZIFFER, an action at or above its policy floor is held rather than blocked: the receipt is issued only once a quorum of two named humans, named in advance in the signed bundle, has signed the exact bytes that will run. The check is on the distinct signing identities, two confirmations from one approver count as one, the quorum is checked at the executor rather than at a button, and a hold nobody signs expires with nothing run. The precise semantics, including what a quorum is not, are in the concepts page. The response case, where holds compete with an incident clock, is in agentic SOC security.