Human-in-the-Loop AI: Where Approvals Belong, and Where They Waste Time

The short answer

In a human-in-the-loop AI workflow, approvals belong where an action is hard to undo or has real impact on customers, money, data or access. Everything that is reversible and low-stakes should run automatically, with spot checks. Put too few checkpoints in and you take on risk; put too many in and people start clicking "approve" without reading.

Most businesses add human review to AI the same way: everywhere at first, then nowhere once it gets tedious. Both extremes fail. The first wastes the time automation was meant to save. The second leaves an AI agent sending, deleting and refunding with nobody watching. Good design puts a small number of meaningful checkpoints exactly where they matter.

What human-in-the-loop means for an AI workflow

Human-in-the-loop simply means a person is part of the process at defined points: reviewing a draft before it goes out, approving an action before it runs, or handling a case the AI has flagged as uncertain. It differs from "human-on-the-loop," where people monitor and can intervene but don't approve each step.

The idea is gaining weight. In a Deloitte survey of 501 US leaders fielded April to June 2026, 61% expected most AI agents to be "generally autonomous, with humans acting as oversight," and 75% agreed that human collaboration with AI agents creates more value than agent-powered automation alone. The direction is clear: fewer approvals, placed better.

The two questions that place every checkpoint

For each action your AI workflow can take, ask two questions:

1. How bad is it if this goes wrong? Think customer harm, money, legal exposure, data and reputation.
2. How easily can we undo it? A draft can be deleted. A sent email, a refund or a deleted record often can't.

The top-right box is where approvals earn their keep. The OWASP guidance on Excessive Agency recommends requiring human approval for high-impact actions, and enforcing that check in the system the agent connects to, not by asking the AI to remember. The bottom-left box is where approvals waste time.

Checkpoints that pay off in a typical small business

Workflow	Let AI do	Human checkpoint
Website enquiries	Read, categorise, draft reply, create CRM lead	Approve replies that include prices or commitments
Invoices	Extract fields, match to purchase orders	Approve any payment and any new supplier bank details
Customer service	Answer from approved knowledge, track orders	Refunds, exceptions, complaints and anything the AI is unsure of
Marketing	Draft posts and emails, suggest audiences	Approve before publishing; check claims and consent
Admin	Summarise meetings, update task lists	Changes to user access, permissions or shared files

If you are still choosing which processes to automate, start with our list of six processes that reliably pay back.

Design approvals people will actually read

Beware automation bias

The risk of a checkpoint is that it becomes a rubber stamp. The EU AI Act names this directly: Article 14, on human oversight of high-risk systems, requires that overseers stay aware of "the possible tendency of automatically relying or over-relying on the output," which it calls automation bias. Even if the Act doesn't apply to your business, the problem does.

Make the decision easy and specific

• Show what will happen, not just what the AI thinks. "Send this email to 3 recipients, one of them new" beats "Approve action?"
• Highlight what changed or what is unusual, such as a new bank account, a larger-than-normal amount or a first-time recipient.
• Batch low-risk reviews into a daily queue instead of interrupting people all day.
• Give a real "no" option with a reason field, and feed rejections back into improving the workflow.
• Route by confidence. Let the AI flag uncertain cases for review instead of asking a person to check everything.

Scope permissions precisely

OpenAI's controls for its always-on dots show a useful pattern. Its Control your dot page offers four rule types: take action without asking, take action when you say so, ask before taking action, and hand off to you. It also makes a point every workflow designer should copy: "Asking your dot to draft replies doesn't give it permission to send them." We cover these agents in more depth in always-on AI agents explained.

Common mistakes

• Trusting a soft checkpoint. OpenAI's Agents API documentation warns that approving a website in its hosted browser "does not enforce confirmation before individual actions." If a confirmation must happen, build it into the workflow so the action physically can't run without it.
• Approvals with no owner. A queue nobody is responsible for becomes a backlog, then a bottleneck, then something people bypass.
• Never removing checkpoints. Review your approval data monthly. If people approve 100% of a category for three months, consider moving it to spot checks.
• Ignoring the attack angle. Approvals are also your last line of defence against prompt injection, so keep them on anything that sends data outside the business.

Key takeaways and a five-point checklist

• Human-in-the-loop works best when approvals sit only on high-impact, hard-to-undo actions.
• Everything reversible and low-stakes should run automatically, with spot checks and logs.
• Approval screens must show consequences and anomalies, or they become rubber stamps.
• Enforce checkpoints in your systems, give each queue an owner, and revisit them monthly.

To put that into practice:

1. List every action the workflow can take.
2. Score each for impact and reversibility, and place it in the grid.
3. Enforce approvals in the system, with a named owner and a target response time.
4. Design each approval screen to show consequences and anomalies.
5. Review approval and rejection rates monthly and adjust.

Pair this with properly scoped agent permissions so that a missed approval can't turn into a major incident.

Frequently asked questions

Does human-in-the-loop mean a person checks every AI output?

No. It means people are involved at defined points. Reviewing everything usually leads to rubber-stamping; reviewing high-impact, hard-to-undo actions is more effective.

How do I know when to remove a human checkpoint?

When the data supports it: a long run of approvals with no edits or rejections, low impact if something slips through, and a reliable way to detect and reverse errors.

Is human oversight a legal requirement for AI?

For some uses and places, yes. The EU AI Act, for example, sets human oversight requirements for high-risk systems. Whether a rule applies depends on your sector and location. This is general information, not legal advice.

Sources

1. AI Agents are Only the Beginning: Deloitte Survey Examines the AI Readiness Gap and Reveals How Enterprises Can Prepare for Agentic Success — Deloitte, August 12, 2026
2. LLM06:2025 Excessive Agency — OWASP Gen AI Security Project
3. Article 14: Human Oversight — EU Artificial Intelligence Act (artificialintelligenceact.eu)
4. Control your dot — OpenAI (ChatGPT Learn)
5. Computer use (Agents API) — OpenAI API documentation

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our Business Process Automation, ai agents & ai solutions services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.