Human Oversight & Approvals

The goal of agent ops is not the most autonomy. It is the right autonomy. Some actions are safe to run alone. Some should be proposed and then approved. Some should never be automated at all. Human-in-the-loop design is the work of deciding which is which and building oversight that people can really do well. Done badly, it is a rubber stamp. Done well, it is your strongest safety control and your way to earn more autonomy over time.

Put your actions in risk tiers

Sort every tool by what happens if it goes wrong. Two questions set the tier. How easy is the effect to undo? And how big is the blast radius: one record, one customer or everyone?

• Tier 0, read-only with no side effects, such as search, look up and summarize. Run on their own, and log them.
• Tier 1, easy to undo and low impact, such as drafting a reply, tagging a ticket or making a calendar hold. Run on their own, with an easy undo and a sample review.
• Tier 2, hard to undo or visible to customers, such as sending an email, changing a record or posting in public. Needs human approval, or autonomy only for narrow, pre-approved templates.
• Tier 3, cannot be undone, or financial, legal or safety-critical, such as deleting data, moving money, changing permissions or signing contracts. A person decides. The agent only prepares the evidence. Or it is not automated at all.

actions:
  kb.search:        { tier: 0 }
  ticket.add_tag:   { tier: 1, undo: "ticket.remove_tag" }
  email.send_draft: { tier: 1 }
  email.send:       { tier: 2, approval: "support_lead", sla_minutes: 30 }
  refund.issue:
    tier: 2
    auto_approve_if: { amount_usd_lte: 20, customer_plan: ["pro","team"], prior_refunds_lte: 1 }
    approval_otherwise: "support_lead"
  account.delete:   { tier: 3, approval: "two_person", agent_role: "prepare_evidence_only" }

Approval patterns

• Approve first (propose, approve, then run), for Tier 2 and 3. The agent pauses with a clear request. A person approves, edits or rejects it.
• Review afterwards, with an undo, for Tier 1. The agent acts. A sample is audited, and anything can be reversed.
• Autonomy within limits: approve automatically inside tight, clear limits such as amount, customer group or how often. Escalate outside them.
• Two keys: two people for the most sensitive actions.
• Autonomy in stages: start everything as approve first, then promote groups of actions to autonomous as the approval data proves they are reliably accepted.

Make approvals easy to do well

The failure of oversight is approval fatigue. A person clicks approve on the fortieth identical request without reading it. Fight it with design. Show the exact action and its inputs. Show the evidence the agent used, quoted and linked. Show what will change, as a diff. Show the estimated cost or impact, and the agent's confidence and open doubts. Make rejecting and editing as easy as approving. Group similar low-risk items together, and save interruptions for what truly needs judgment.

{
  "request_id": "apr_2291",
  "agent": "billing-support",
  "action": "refund.issue",
  "arguments": { "customer_id": "c_889", "amount_usd": 84.00, "reason": "double charge" },
  "evidence": [
    { "quote": "Charged twice on Oct 2 (two identical $84.00 line items)", "source": "billing_export row 4471-4472" },
    { "quote": "Customer reported duplicate charge", "source": "ticket #7731" }
  ],
  "impact": "Reduces October revenue by $84.00; customer lifetime value $1,240",
  "confidence": 0.93,
  "open_questions": ["Could the second charge be a legitimate add-on? Add-on records: none found"],
  "options": ["approve", "approve_with_edit", "reject", "ask_agent_more"]
}

When to escalate

• Low confidence, or evidence that conflicts.
• A policy rule is hit, or a request falls outside the agent's written scope.
• A high money value, a VIP or regulated customer, or a sensitive area such as health, law or safety.
• Repeated failure: the same task failed N times.
• Signs of strong emotion or risk from the user. Hand over to a person with the full context, not a cold restart.
• Something new: inputs unlike anything in the test set.

Responsibility and records

Every important action should be traceable. Which agent version proposed it? On whose behalf? Which person approved it, or which rule approved it automatically? When, and based on what evidence? Keep this in an append-only audit log, apart from the debug traces. When something goes wrong, or a regulator or customer asks, the AI did it is not an answer. The chain of authorization is.

Measure the oversight itself

• Approval rate and edit rate for each type of action. If nearly every request is approved without edits over thousands of cases, that is evidence the action can be promoted to autonomous.
• Override and reversal rate: how often people undo what the agent did.
• Time to approve and queue length. Slow oversight quietly slows the product, or tempts people to skip it.
• Escalation precision: were the escalations really needed?