In front of anything the agent cannot undo, anything a customer will see unedited, and anything where being wrong costs more than being slow.

Everywhere else, a human in the loop is a tax you pay forever for comfort you only needed in the first fortnight.

The useful version of this decision is not how much oversight to have, it is which specific steps get it and what the person is actually looking at.

"Human in the loop" gets said in every AI conversation and almost never gets defined. It usually means somebody will keep an eye on it, which is not a control, it is a hope.

The phrase hides three different jobs

A person can sit in three places, and they are not interchangeable.

Approving an action before it happens. The agent proposes, a person says yes, the action runs. This is the only one of the three that actually prevents anything.

Reviewing after the fact. The agent acts, a person checks a sample later. This catches patterns and drift. It prevents nothing on the day.

Handling what the agent refuses. The agent recognises it is out of its depth and hands over. This one is the most valuable and the most often skipped, because it needs the agent to know what it does not know.

Most teams say "human in the loop" and build the second one, then are surprised when something went out on Tuesday that nobody stopped.

What the ACSC asks for

Australia's Careful adoption of agentic AI services guidance, published 1 May 2026 with CISA, the NSA and the UK, Canadian and New Zealand cyber centres, asks for "human control points throughout the agent workflow, such as live monitoring and interruption during task execution, mandatory human approval for decision-making steps, auditing and reversibility following task execution".

Read that carefully and it is describing all three jobs above, at different points, doing different work. It also says something that cuts the other way in the same document: "Agentic AI systems are intended to operate without continuous human intervention."

Both are true, and the tension between them is the actual design problem. An agent that needs a person at every step is a very slow form. An agent that needs a person at no step is a liability. The work is choosing the steps.

The four tests we use

For any given step, a person belongs there if the answer to any of these is yes.

Can it be undone? If not, a person approves it. Sent email, SMS, an invoice, a booking confirmation, a webhook into another system. After it happens there is nothing to reverse.

Will a customer see it unedited? Anything going out in your name in its final form gets read by someone first, at least until you have enough volume to trust the pattern.

Does being wrong cost more than being slow? A misfiled contact costs minutes. A wrong refund, a wrong price, a wrong account merged into another client's record costs a relationship.

Does it decide something about a person? This is the Australian one, and it is below.

If all four are no, leave the human out. Adding oversight to low-stakes reversible work is how teams end up turning the agent off six weeks later without telling anyone, because approving 300 things a day is worse than doing the job by hand.

The Australian test: is it a decision about a person?

From 10 December 2026, the Privacy and Other Legislation Amendment Act 2024 requires an Australian privacy policy to disclose automated decision-making that significantly affects an individual.

This changes the question from a preference to a documented position. If an agent decides who gets contacted, what they are offered, who gets chased for money or who gets declined, that is a decision about a person, and you need to be able to describe how it is made. A human approval step is one honest answer to that. So is a clear disclosure and no human. What does not work is not having thought about it.

We covered the disclosure itself in what has to go in your privacy policy from 10 December.

The part nobody designs: what the person is looking at

A human control point is only as good as what it shows. An approval screen with a yes and a no button, and no reason, produces a person clicking yes, which is worse than no oversight because now it is documented.

A useful approval step shows what the agent is about to do, what it based that on, and what it is unsure about. If a reviewer cannot tell a good proposal from a bad one in a few seconds, the step is decoration.

Two practical measures, both of which we watch on live builds:

  • Approval rate. If a reviewer approves 99% of what they see, the step is not catching anything and the threshold is wrong. Either widen what the agent does on its own, or narrow what it sends for review.
  • Time per decision. If it is under two seconds, nobody is reading it.

What we do on client builds

We start with more human control points than the client wants and remove them on evidence.

Version one sends far more for approval than it needs to, and every approval is recorded with what the reviewer did. After a few weeks that record shows which categories the agent gets right every time, and those come out of the loop. The ones with a real rejection rate stay in, permanently.

It goes the other way too. Reviewers reject things for reasons the brief never anticipated, and those become rules or a refusal path.

The alternative, which is guessing the right level of oversight up front and shipping it, is how you get either an agent nobody trusts or an agent nobody is watching. Before any of it, we check the data underneath, because an agent inherits whatever is already wrong: five checks we run first.

In short

Put a person in front of what cannot be undone, what a customer sees unedited, what costs more to get wrong than to get slowly, and what decides something about an individual. Leave them out of everything else.

Then design what the reviewer sees, because an approval step with no reasoning attached produces rubber stamps and a paper trail proving you had oversight, which is the worst of both.

Frequently asked questions

What does human in the loop mean for AI agents? It means a person occupies a defined point in the agent's workflow, in one of three roles: approving an action before it runs, reviewing a sample after the fact, or handling cases the agent hands over. Only the first prevents anything on the day.

Does the ACSC require human oversight of AI agents? Its Careful adoption of agentic AI services guidance, published 1 May 2026, recommends human control points throughout the agent workflow, including interruption during execution and mandatory human approval for decision-making steps. The same document notes agentic systems are intended to operate without continuous human intervention, so the work is choosing which steps get a person.

Which AI agent steps need human approval? Any step that cannot be reversed, any output a customer sees unedited, any step where an error costs more than a delay, and any decision about an individual that significantly affects them.

Does Australian privacy law require a human in the loop? It does not mandate one. From 10 December 2026 it requires your privacy policy to disclose automated decision-making that significantly affects individuals, so you need a described and defensible position on how those decisions are made.

Sources

Want help working out which steps in your process need a person and which do not? Talk to us.