An agent prepares payments and sends each one for approval before executing. There is a person in the loop. That person receives a few hundred requests a day, and each request shows the amount and a button. It does not show why the payment was created, which data the agent used, or what fell outside the pattern.
The human step exists. The question that matters is which decision that person is able to make.
Human oversight costs attention, and attention is a finite resource with a price. When a company spends that resource confirming what was already correct, it is gone by the time an expensive decision arrives. The design of oversight, then, is not an abstract safety question. It is an allocation decision.
The approval queue spends attention where it returns least
If every action requires approval, the flow looks conservative. The practical effect is different. Low-impact actions and high-consequence decisions start competing for the same queue, in the same format, with the same seconds of screen time.
AWS treats uniform oversight as a design error in its guidance for agents. Applying the same level of review to every action creates bottlenecks in routine activity and leaves higher-consequence decisions without adequate attention. The Government of Canada guide on agentic AI recommends planning how much oversight will be needed and how it will be sustained, and explicitly names human-in-the-loop fatigue as a problem to consider as agent use grows.
The cost shows up on both sides. On one side, routine processes wait for a click that changes nothing. On the other, the decision that needed judgment arrives at position 180 in a queue. More review does not produce better review.
The reviewer errs in the system's direction, not against it
There is a second reason not to treat human approval as a guarantee. People tend to accept an automated recommendation with less questioning than it deserves. The behavior has a name, automation bias, and it appears explicitly in the European AI Act when the regulation addresses oversight of high-risk systems. The rule requires those responsible for oversight to remain aware of the tendency to over-rely on system outputs.
A review published in 2025 in AI & Society analyzed studies on over-reliance on AI recommendations and found that the behavior varies with expertise, trust, verification complexity and how the information is presented. The interface, therefore, is part of the control. A system that presents the answer as certain, hides relevant uncertainty or makes verification expensive pushes the reviewer toward confirmation.
That changes what the company should measure. Counting approvals records activity. Checking whether the reviewer was able to disagree records control.
Approving first works when the effect is hard to undo
The division below is a WatchZ advisory proposition. It organizes four distinct functions of human oversight, and each one solves a different problem.
The first function is deciding before the agent produces a consequence. It makes sense when a choice requires judgment and when the intervention lands before an effect that is expensive to reverse. Payment above a threshold, contract cancellation, a change to published pricing and access provisioning belong in this category.
The goal is not to record a human signature in the process. It is to let someone assess a decision that can still change. Once the action has produced its effect, the approval has become an accounting entry.
Routing exceptions trades volume for relevance
The second function inverts the pattern. The process continues within known conditions, and only the exception reaches a person. An exception appears when one rule conflicts with another, when required information is missing, or when the case falls outside the expected pattern.
In this design the person does not review everything. They receive the cases where judgment adds something the automated flow cannot resolve safely. The economic gain is direct. The same hour of attention now covers ten difficult decisions instead of four hundred trivial ones.
The alert summons whoever did not need to watch the flow
The third function starts outside the flow. The agent works, monitoring observes, and certain signals stop the process or request intervention. A threshold exceeded, unexpected behavior, a technical control detecting something out of rule.
Here the person does not follow every step. They need to be able to step in on time when the system shows that something deserves attention, which moves the requirement to the design of the alert. An alert that always fires trains the organization to ignore it, and an alert that never fires is not a control.
The sample finds the error no rule anticipated
The fourth function happens after execution. Not every error can be anticipated before the operation starts, and part of oversight exists precisely to find patterns, deviations and problems the existing controls do not know about.
The Government of Canada guide recommends occasional checks and comparison between agent output and work done by human specialists, to detect quality loss or behavioral drift. That review blocks no action at all. It answers whether the controls are still working, and it is the only one of the four functions that detects silent degradation.
Four conditions tell you whether an approval point works
Before adding an approval step, it is worth testing it against four questions.
The person knows what they need to assess. Without knowing which risk to look for, the review is superficial by construction.
The person receives enough information to decide. Showing only the conclusion rarely suffices. Depending on the case, they need the proposed action, the relevant data, the rules applied and what fell outside the pattern.
The person can genuinely disagree. The process has to allow rejecting, correcting, requesting more information or stopping execution, without an operational cost that discourages use.
There is time to act. An approval that arrives after the consequence does not work as prevention.
A fifth question is missing, and it is usually forgotten. What happens when nobody responds. AWS recommends that approval workflows have deadlines and escalation paths. Without them, the process stalls indefinitely or the operation invents an informal shortcut to keep running, and the informal shortcut is worse than no control at all, because it appears in no audit.
The same proportionality reasoning appears in Article 14 of the AI Act, which requires oversight measures proportionate to the risk, the level of autonomy and the context of use, and establishes that the person be able to understand capabilities and limits, interpret outputs and, where appropriate, disregard, override or reverse an output. The legal obligation applies to the high-risk scope defined by European legislation. The management principle drawn from it applies to any agent with material effect, and it connects to how much autonomy each agent receives.
Permissions and limits solve upstream what the queue would solve downstream
There is a frequent sequencing error. The company uses human review to correct a process that could have been constrained by design.
If an agent should not access certain data, the better protection is removing the permission. If it should not spend above a threshold, the system imposes the limit. If it should not execute many actions within seconds, there is a rate limit. If a specific action should never happen without authorization, the system itself blocks execution until approval arrives.
The Government of Canada guide recommends combining technical controls with human in the loop, citing limited permissions, read-only access where possible, data and frequency limits, action logging, and an external mechanism to pause or disable the agent.
The effect is arithmetic. Each technical control removes an entire class of decisions from the human queue, and the attention left over goes to the cases where judgment, context or choice are still required. That calibration between use-case exposure and control intensity is what sustains AI governance proportional to risk, and it is also what separates the company that scales agents from the one that stalls on them.
The number of approvals does not measure the quality of oversight
A company can record hundreds of human approvals a day and still hold weak oversight. It can record few and hold strong controls. The difference sits in the design, not in the volume.
Good oversight makes explicit which decision needs a person, why that decision needs human judgment, which information the person receives, what they can change, how much time exists to act, and which controls operate before and after that point. Companies already running artificial intelligence with proportional governance treat those six answers as part of the agent design, not as policy written after the first incident.
The inventory is simple to start. List the points where a person participates in the flow and describe, for each one, which decision they should make. Where no clear decision exists, the step is consuming attention without producing control, and the manager who distributes autonomy answers for that bill.
At which points in your flow does the human decision change what happens, and at which does it only confirm what the agent already decided?
Sources
- National Institute of Standards and Technology. "AI Risk Management Framework 1.0, Appendix C: AI Risk Management and Human-AI Interaction" (2023). https://airc.nist.gov/airmf-resources/airmf/appendices/app-c-ai-risk-management-and-human-ai-interaction/
- Amazon Web Services. "AGENTREL02-BP05 Establish tiered human oversight and approval workflows", Agentic AI Lens. https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentrel02-bp05.html
- Government of Canada. "Guide on the Use of Agentic Artificial Intelligence" (May 22, 2026). https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/responsible-use-ai/guide-use-agentic-artificial-intelligence.html
- European Union. "Regulation (EU) 2024/1689 - AI Act, Article 14, human oversight" (2024). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Zhu, Liming; Lu, Qinghua; Ding, Ming; Lee, Sung Une; Wang, Chen. "Designing meaningful human oversight in AI", AI and Ethics (May 4, 2026). https://link.springer.com/article/10.1007/s43681-026-01147-7
- Romeo, Giuseppe; Conti, Daniela. "Exploring automation bias in human-AI collaboration: a review and implications for explainable AI", AI & Society (July 3, 2025). https://link.springer.com/article/10.1007/s00146-025-02422-7
- Lazaros, Konstantinos; Vrahatis, Aristidis G.; Kotsiantis, Sotiris. "Human-in-the-Loop Artificial Intelligence: A Systematic Review of Concepts, Methods, and Applications", Entropy 28(4):377 (March 26, 2026). https://www.mdpi.com/1099-4300/28/4/377
Note: the four functions of human oversight are a WatchZ advisory proposition, with no correspondence to a regulatory standard or a third-party framework. The AI Act is cited only for the proportionality principle and for the effective-oversight conditions it establishes for high-risk systems.
