AI Governance Engineer
GitHub
On this page

Pattern: Human-in-the-loop Gate

A human approval step at a defined high-consequence decision point, so an agent's autonomy stops exactly where the stakes justify the latency.

Layer 04 · Runtime Controls & Observability In the chapter 05 catalogue

One working control on the engineering side of AI governance.

Summary: Require human approval at a defined, high-consequence decision point before an agent’s action takes effect, so that autonomy is bounded by a person exactly where the stakes justify the latency. Oversight is a designed checkpoint, not an afterthought.

Human-in-the-loop Gate A sequence diagram generated by Archify. propose action routine: auto under guardrails high-consequence: human required approve within time box execute action reject or timeout: drop log approver, context, decision Classify by consequence Human decides in a time box Execute or drop, then log Agent · proposes action · Sequence participant Agent proposes action Policy check · human required? · Sequence participant Policy check human required? Reviewer · named human · Sequence participant Reviewer named human Action target · payment, denial · Sequence participant Action target payment, denial Evidence log · approver, decision · Sequence participant Evidence log approver, decision Legend request return security async trace default message
Human-in-the-loop GateFor the actions the policy marks as needing a human, the agent pauses, a named reviewer decides within a time box, and the decision is logged as evidence. Define which actions need a human by policy, not by habit. Generated from the Body of Knowledge.Open interactive diagram (opens in a new tab)

Objectives

Insert meaningful human oversight where an action is irreversible or high-impact, and record the decision as evidence.

Target users

AI governance engineer, product owner, risk owner.

Impacted stakeholders

Affected persons, users, model owners, regulators.

Relevant principles

Start from a named failure mode or harm; register and bound every actor before it acts.

Context

An agent whose actions include some that are irreversible or affect people’s rights (a payment, a denial, a publication) alongside many that are routine.

Problem

Full autonomy over a high-consequence action removes the human oversight the law and the risk both require; full manual review over every action destroys the value of the agent. Undifferentiated oversight fails in both directions.

Solution

Classify actions by consequence. For the high-consequence class, gate the action behind a human approval step with enough context to decide, and block the action until approval. Log the approver, the context and the decision as evidence. Keep the routine class autonomous under guardrails. This realises the EU AI Act Art. 14 human-oversight requirement 1 at the point of action.

Singapore’s framework for agentic AI describes the same gate: organisations “should define significant checkpoints or action boundaries that require human approval, especially before sensitive actions are executed”, irreversible ones among them, and keep approval requests “contextual and digestible, while making the risk clear” (IMDA, p. 29). It also asks them to track the human override rate, since a low rate “may signal rubber-stamping behaviours”, and to deny action by default when the approval infrastructure fails (p. 30)4.

Consequences

Oversight lands where it matters without throttling routine work, and the approval is auditable. The cost is designing the consequence classification and the latency it adds to gated actions.

Kill Switch / Circuit Breaker; Runtime Guardrail; Policy Card; Agent Identity & Scoped Credentials; FRIA-as-Code.

Maps to: EU AI Act Art. 14 · ISO/IEC 42001 · NIST AI RMF (Manage) · OWASP Agentic ASI02 · Layer 04 Runtime Controls & Observability.

Threat IDs follow the OWASP Top 10 for Agentic Applications 2026 2 and function labels the NIST AI RMF3. Mappings are illustrative, not a claim of conformity.

Sources

  1. [1] Regulation (EU) 2024/1689 (AI Act), Art. 14 (human oversight of high-risk AI systems). Publications Office of the EU (EUR-Lex). 2024-07-12. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (verified: primary)
  2. [2] Top 10 for Agentic Applications 2026 (ASI IDs). OWASP GenAI Security Project. 2025-12-09. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ (verified: primary)
  3. [3] AI Risk Management Framework (AI RMF 1.0; Govern, Map, Measure, Manage). NIST. 2023-01-26. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary)
  4. [4] Model AI Governance Framework for Agentic AI, v1.5 (section 2.2.2, design for meaningful human oversight, pp. 29-30: checkpoints that require human approval; override rate; deny by default when approval infrastructure fails; published 2026-05-20, updated 2026-06-05). IMDA. 2026-06-05. https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf (verified: primary)
Edit this page on GitHub
Cite this pattern

García Aibar, J. (2026). Pattern: Human-in-the-loop Gate. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), chapter 05, Patterns. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/patterns/human-in-the-loop-gate. CC BY 4.0

BibTeX

@misc{aige2026bok,
  author  = {Jorge García Aibar},
  title   = {{AI Governance Engineering: The Thesis \& Body of Knowledge}},
  chapter = {05. Patterns: Human-in-the-loop Gate},
  year    = {2026},
  version = {0.5.0},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/patterns/human-in-the-loop-gate},
  note    = {Version 0.5.0}
}
Share on LinkedIn
Around Human-in-the-loop GateThe patterns Human-in-the-loop Gate is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern01 Govern-as-Code04 Runtime ControlsHuman-in-the-loop GateRelated patterns (5)Agent Identity & Scoped Credentials · Related patternAgent Identity & Scoped…FRIA-as-Code · Related patternFRIA-as-CodeKill Switch / Circuit Breaker · Related patternKill Switch / Circuit BreakerPolicy Card · Related patternPolicy CardRuntime Guardrail · Related patternRuntime GuardrailObligations (3)EU AI Act Art. 14: human oversight · Names this patternEU AI Act Art. 14NIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGEOWASP Top 10 for Agentic Applications 2026 · Names this patternOWASP AgenticControls (10)AIGE-CTL-AGENT-009 Approval log, bound to the call · Names this patternApproval log, bound to the callAIGE-CTL-AGENT-033 Approval requests a person can read · Names this patternApproval requests a person can…AIGE-CTL-AGENT-006 Checkpoint before every write · Names this patternCheckpoint before every writeAIGE-CTL-AGENT-015 Checkpoints on irreversible actions, failing closed · Names this patternCheckpoints on irreversible…AIGE-CTL-AGENT-034 Oversight audited per approver · Names this patternOversight audited per approverAIGE-CTL-DEPLOY-003 Oversight by trained people with authority to stop · Names this patternOversight by trained people…+4 more+4 more: AIGE-CTL-AGENT-038 Payments on a standard protocol, behind the pay checkpoint, AIGE-CTL-AGENT-032 Plan reviewed before it runs, AIGE-CTL-EVAL-004 Tool and Action Mediation, AIGE-CTL-AGENT-041 User-set approval thresholdsCases (2)England's 2020 A levels: a centre model applied to individual students · Names this pattern2020 A-level gradesAn internally deployed model published a researcher's GitHub token in a public repository · Names this patternGitHub token exposed…Source: the pattern catalogue, theobligation register, the opencontrols and the cases
Around Human-in-the-loop GateThe patterns Human-in-the-loop Gate is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern01 Govern-as-Code04 Runtime ControlsRelated patterns (5)Agent Identity & Scoped Credentials · Related patternAgent Identity & Scoped…FRIA-as-Code · Related patternFRIA-as-CodeKill Switch / Circuit Breaker · Related patternKill Switch / Circuit BreakerPolicy Card · Related patternPolicy CardRuntime Guardrail · Related patternRuntime GuardrailCases (2)England's 2020 A levels: a centre model applied to individual students · Names this pattern2020 A-level gradesAn internally deployed model published a researcher's GitHub token in a public repository · Names this patternGitHub token exposed…Obligations (3)EU AI Act Art. 14: human oversight · Names this patternEU AI Act Art. 14NIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGEOWASP Top 10 for Agentic Applications 2026 · Names this patternOWASP AgenticControls (10)AIGE-CTL-AGENT-009 Approval log, bound to the call · Names this patternApproval log, bound…AIGE-CTL-AGENT-033 Approval requests a person can read · Names this patternApproval requests a person…AIGE-CTL-AGENT-006 Checkpoint before every write · Names this patternCheckpoint before every…AIGE-CTL-AGENT-015 Checkpoints on irreversible actions, failing closed · Names this patternCheckpoints on irreversible…AIGE-CTL-AGENT-034 Oversight audited per approver · Names this patternOversight audited…AIGE-CTL-DEPLOY-003 Oversight by trained people with authority to stop · Names this patternOversight by trained people…+4 more+4 more: AIGE-CTL-AGENT-038 Payments on a standard protocol, behind the pay checkpoint, AIGE-CTL-AGENT-032 Plan reviewed before it runs, AIGE-CTL-EVAL-004 Tool and Action Mediation, AIGE-CTL-AGENT-041 User-set approval thresholdsHuman-in-the-loopGateSource: the pattern catalogue, the obligation register, the open controls and thecases
Around Human-in-the-loop Gate The patterns listed with this one, in their layer colour, and the obligations, open controls and incident cases that name it. Follow a node to see why the pattern is worth building, and what to build with it.
Data table
What Human-in-the-loop Gate connects to
FamilyItemRelation
Related patternsAgent Identity & Scoped CredentialsRelated pattern
Related patternsFRIA-as-CodeRelated pattern
Related patternsKill Switch / Circuit BreakerRelated pattern
Related patternsPolicy CardRelated pattern
Related patternsRuntime GuardrailRelated pattern
ObligationsEU AI Act Art. 14: human oversightNames this pattern
ObligationsNIST AI RMF MANAGENames this pattern
ObligationsOWASP Top 10 for Agentic Applications 2026Names this pattern
ControlsAIGE-CTL-AGENT-009 Approval log, bound to the callNames this pattern
ControlsAIGE-CTL-AGENT-033 Approval requests a person can readNames this pattern
ControlsAIGE-CTL-AGENT-006 Checkpoint before every writeNames this pattern
ControlsAIGE-CTL-AGENT-015 Checkpoints on irreversible actions, failing closedNames this pattern
ControlsAIGE-CTL-AGENT-034 Oversight audited per approverNames this pattern
ControlsAIGE-CTL-DEPLOY-003 Oversight by trained people with authority to stopNames this pattern
ControlsAIGE-CTL-AGENT-038 Payments on a standard protocol, behind the pay checkpointNames this pattern
ControlsAIGE-CTL-AGENT-032 Plan reviewed before it runsNames this pattern
ControlsAIGE-CTL-EVAL-004 Tool and Action MediationNames this pattern
ControlsAIGE-CTL-AGENT-041 User-set approval thresholdsNames this pattern
CasesEngland's 2020 A levels: a centre model applied to individual studentsNames this pattern
CasesAn internally deployed model published a researcher's GitHub token in a public repositoryNames this pattern

Obligations this pattern evidences

Register rows that list this pattern among the patterns that build their evidence. Mappings are illustrative, not a claim of conformity.

When these obligations applyThe obligations Human-in-the-loop Gate evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadAs of 2026-09-241still to come2027-12-022028-08-022030-08-02EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14Art. 14Art. 142 without a date (Voluntary)Source: the obligation register(/obligations)As of 2026-09-24
When these obligations applyThe obligations Human-in-the-loop Gate evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadDateits place on the time axis1still to come2026202720282029203020312027-12-022028-08-022030-08-02EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14Art. 14Art. 14As of 2026-09-242 without a date (Voluntary)Source: the obligation register (/obligations)As of 2026-09-24
When these obligations apply Each obligation this pattern evidences, on the date it first applies, drawn by its status in the register, and on each later dated step (a square, filled once reached); the dashed line is the date the rows were last reviewed. What comes before the line is already due, so the pattern's evidence is needed now; what comes after it sets the deadline to build it by.
Data table
When the obligations Human-in-the-loop Gate evidences apply
DateObligationStepStatus
2027-12-02EU AI Act Art. 14: human oversightApplies fromDeferred
2028-08-02EU AI Act Art. 14: human oversightLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2030-08-02EU AI Act Art. 14: human oversightLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
No dateNIST AI RMF MANAGEVoluntary
No dateOWASP Top 10 for Agentic Applications 2026Voluntary

Cases where it applies

Incident post-mortems that name this pattern as a control that would have caught the failure.

Draft controls in the open control profiles that build on this pattern. A control states the requirement and the evidence it must leave behind.