Human-in-the-loop

Human-in-the-loop means a person makes decisions or gives approvals at defined points in an automated process. The system prepares the action, while the human reviews it and takes responsibility for the outcome.

How it works

An automated workflow or an agent processes a task up to a specific point. It then presents a recommendation to a person, including the reasoning and supporting evidence. This person can then confirm, modify, or reject the recommendation. The decision points for human intervention depend on the associated risk. Routine actions run automatically, but high-impact interventions require manual approval.

For example, an agent investigates a suspicious login to the account of a member of the executive board. It finds evidence of an account takeover and recommends revoking all active sessions. An analyst must make the final decision because the account has special protection. The analyst reviews the evidence, confirms the action, and informs the individual by phone.

What to look out for

• Define and document approval points based on the level of risk involved.
• Provide enough context for each decision. Approvals without evidence can become a mere formality.
• Be mindful of approval fatigue. A person approving a hundred items per hour loses diligence.
• Measure how often humans modify recommendations. This highlights areas for system improvement.

Variants

A common distinction is made between "in the loop" and "on the loop". In the first case, a human must approve every single action. In the second, the system acts autonomously while a human supervises and can intervene.

Switzerland and regulation

The revFADP (revised Federal Act on Data Protection) gives affected persons the right to be informed about automated individual decisions with significant consequences and to state their position. This is rarely directly relevant for decisions made within a SOC. However, human approvals help to assign responsibility clearly.

How we implement it

Our agents handle routine cases autonomously within the agreed mandate. They submit interventions with major consequences to our analysts for approval.