Human in the loop AI: automation with a person in between

Human in the loop means a person reviews an automation before it does something irreversible; at Oase Creative, 203 approvals were on record on 30 October 2026, each tied to a real message and usable once.

What does human in the loop mean?

Human in the loop means: the automation stops and waits for a person.

An AI agent or workflow does the groundwork, such as drafting an email, filling in a quote or preparing a message. At a fixed point the system halts. A person looks, edits or rejects, and only after that approval does the action go ahead. That point almost always sits just before something happens that you cannot take back. Think of a sent email, a published article, a payment or a changed customer record.

On our service page we call this AI automation with a person in between. We run it ourselves too. Our own agent system writes drafts, schedules posts and answers enquiries, but none of it goes out without a recorded approval from Louie.

The term comes from engineering and sounds more abstract than it is. A colleague who reads your quote once more before it goes out is also human in the loop. The difference with automation is that the system itself has to know where to stop. And that the person standing there actually looks. Most of this article is about that second part, because that is where it goes wrong in practice.

What is the difference between human in, on and out of the loop?

The difference is the moment the person takes part. Before the action, during the action, or not at all.

• Human in the loop: the system waits for approval. No approval, no action.
• Human on the loop: the system acts on its own. A person watches through alerts or a log and can step in or stop it.
• Human out of the loop: there is no person in between. The system does the work from start to finish.

None of the three is right or wrong. The question that decides: what does a mistake cost, and can you undo it? A wrongly sorted enquiry in your CRM takes ten seconds to fix. A wrong email to a hundred customers cannot be recalled.

Most work processes contain all three. An agentic workflow lets an AI agent choose its own next step. That is exactly why you want to decide the mode per step, not once for the whole process.

How often is there really a person in between?

Less often than you would think. Researchers analysed public n8n workflows that contain a language model. Only 2.78% of the 6,003 workflows ask a person for approval before an external action, and in 26.52% the model output goes straight to an action without any check.

An honest caveat: these are templates that users share, not what companies actually run in production. A template is a starting point. Still, it says something about what people copy as normal.

In October 2026 the European Commission published a Flash Eurobarometer among more than twelve thousand owners of small and mid-sized companies. The finding: 42% of those companies already use AI or algorithmic management, and only 2% of decisions are fully automated. So in almost everything companies automate, a person still has a say. The only question is whether that person sits in the right place.

The tools do not always make that easy. In Zapier the step is called Request Approval. There you choose what happens when the reviewer says no: "Stop run" or "Continue run". And what happens when nobody responds in time: "End run" or "Skip and continue". Pick the wrong option and your workflow simply carries on after a rejection.

n8n handles it per tool: the agent pauses before a tool and waits for Approve or Deny, through Slack, Telegram or email among others. The good part: the reviewer sees the exact values the agent wants to use. That is precisely what you want.

Why is an approval button not yet a check?

Because people wear down, and because an approval can be attached to the wrong thing.

The more you review, the easier you approve. Researchers followed 400 repeat reviewers who assessed code from AI agents. Across the seven-month measurement, the approval rate went from 30.1% to 36.8%, and inline comments per review were 22% lower. The same reviewers did not show that pattern on code written by people. The authors read it as habituation under a growing workload. This is a preprint, and the researchers do not rule out that the agents' code simply got better over those months.

People catch the easy mistakes. In an experiment with 2,784 participants, people checked figures an AI had pulled from annual reports. Spelling and digit errors were corrected 82% of the time, errors that require understanding the rules only 31%. The most painful result: when rejecting cost extra work, participants accepted a wrong suggestion more often. A check where saying no is expensive produces more approvals.

An approval can be attached to something other than you think. A paper from September 2026 calls it Loopjacking: you approve action A, and the system uses that approval for action B. That can happen in two ways: the reviewer gets an incomplete view of what will happen, or the approved action is swapped after the approval. The author reproduced it in Agno AgentOS, LangGraph Agent Server and OpenClaw; the last one got a fix in version 2026.2.24. Only the OpenAI Agents SDK held up in the same test, because it binds the approval to exactly that one call. The fix the paper prescribes: show the reviewer the complete action, and at execution time compare whether it is still exactly the same action.

An "Approve" button is only a check when three things hold:

1. The reviewer sees everything. The full text, the recipient and the source, not a summary.
2. Saying no takes no more effort than yes. Rejecting is one tap, just like approving.
3. The approval is bound to that one action. It does not cover the next one, nor an edited version.

How does human in the loop work in our own system?

In our system every approval is tied to a real message from Louie, can be used once and expires after 30 days. It has worked this way since 23 September 2026. Before that, "approved" in our content calendar was a text field any script could fill in. The publishing script could not tell the difference.

Now it works like this. Louie approves in Telegram. The system records that approval under the name of the item, for example a blog or an email. Before every publication or send, the script checks three things:

• Does the message really exist? The message ID has to be in our log of incoming messages, and come from Louie's own chat. So an agent cannot make up an approval.
• Is it not too old? An approval on a message from more than 30 days ago no longer counts. What was right then may not be right now.
• Has it been used already? After a successful publication or send, the approval is spent. The same message cannot serve that item a second time.

This is where it stood on 30 October 2026:

That last row needs explaining, or the picture is off. One message from Louie can approve a whole batch, such as a series of follow-up emails. Each email still gets its own record that is spent once. Of the 188 spent approvals, 127 belong to a sent email and 51 to a publication.

There is also a limit we will not gloss over. The approval is tied to the item, not to a fingerprint of the text. The publishing script does write a fingerprint of the text to the log beforehand, so you can see afterwards exactly what went live. But a change after the approval and before publication is not blocked by the lock itself. According to the Loopjacking paper, that is exactly where things go wrong. So that is our next improvement: record the fingerprint at the moment of approval, and compare it at publication.

Two more rules apply without exception. Replies to clients are always a draft; our system never sends them itself. And for the newsletter we built for family restaurant Pluis, a person approves every email before it goes out. Sign-ups do go to the mailing list automatically every hour. That is the table above in real life: in the loop where it goes out, out of the loop where it is a fixed rule.

When does the law require a person in the loop?

For decisions about people, and for AI systems that EU law classifies as high risk. For most email and content flows of a small business it is a design choice, not an obligation. This is not legal advice; if you are unsure about your situation, check it.

The GDPR applies today. When a system makes a decision about a person entirely on its own, with legal or similarly significant effect, that person has a right to human intervention. On 23 July 2025 the Dutch data protection authority (AP) published guidance on meaningful human intervention. The core: that intervention may not have "only a symbolic function". As obstacles for the reviewer, the AP names time pressure and an unclear system, among others. An employee who simply adopts the system's score does not count.

Translate that to your own process and you see where it pinches. If someone has to clear fifty applications before five o'clock, the system's outcome becomes the decision. If the reviewer only sees a score and not the CV, there is nothing to weigh it against. Our own approvals face the same thing on a smaller scale: a blog that has to go live at nine tomorrow gets a quick approval more easily than one scheduled a week out. That is why we prepare drafts well ahead of their publication date, so the approval is not made under time pressure.

The AI Act requires human oversight for high risk. Article 14 of the AI Act says high-risk systems must be built so that natural persons can effectively oversee them. Notably, the text names automation bias explicitly: the tendency to rely on what the system says. That is the same wear as in the studies above, now in statute. For Annex III systems, including filtering job applications and creditworthiness of individuals, it applies from 2 December 2027 under the amending regulation 2026/1744.

The table is our reading of the sources, not a position of the AP or the Commission. But the pattern is clear: where people are concerned, the law demands that the human in the loop actually adds something. Where your own content and email are concerned, you demand it of yourself.

Where do you not need a person in the loop?

Wherever a mistake is cheap and you can undo it quickly. Putting a person on every step sounds safe, but it backfires. With enough approvals a day, a reviewer stops reading the last ones closely. That is exactly the habituation from the research on AI code.

That is why we run most of our own system without a person in between. Sorting email, moving data between systems, building reports, running checks: that happens on its own. Someone does watch through alerts and a log, but nothing waits for an approval.

A simple test per step:

1. Does it go out, under your name? Then in the loop.
2. Can you undo it within a minute? Then on the loop is usually enough.
3. Is it a fixed rule without judgement? Then out of the loop, with an alert if it fails.
4. Is it about a person, with consequences for that person? Then in the loop, and read the GDPR paragraph above once more.

A few sharp checks you actually read are safer than dozens nobody looks at anymore. In our own system we therefore look not only at how many approvals there are, but also at how many hang on the same message, as in the table above.

How do you set up human in the loop properly?

With five questions you answer before going live, to yourself or to whoever builds the automation for you. Each question comes from one of the failures above.

On top of that, three habits that keep the person sharp:

• Make no as easy as yes. One button, no form with a mandatory explanation. Whoever has to justify a rejection approves faster.
• Count the rejections. A reviewer who rejects nothing for months may no longer be checking. That is not a reproach; it is a signal to set up the check differently.
• Put the content first, not the score. A green tick or a red risk score steers the judgement. Show the reviewer the text first, and only then what the system thinks of it.

Anyone who sets this up finds that most of the work is not in the build but in running it afterwards. Someone has to keep track of whether the checks still do what they should. We call that managed automation: the builder stays responsible after delivery, including the question of whether the human in the loop still really looks.

What does it cost to keep a person in the loop?

Mostly the reviewer's attention. For us that is Louie, and every approval takes a slice of his day. Over a week those slices add up, which is why the number of moments a person has to look belongs in the design, not left to chance.

You see that in our own system in the ratio between approvals and messages. Behind 203 recorded approvals sit 43 messages from Louie. He does not approve 203 separate things; he reviews batches that the system records neatly per item. He reviews a series of follow-up emails in one go; each email is then checked and spent separately. That keeps the work for the person small without losing the per-action check.

Beyond approvals, an agent system needs maintenance too. We tracked for 134 days what our own system asked of us, and in nearly a third of the failed runs it was our own quality gate refusing. That gate did what it is there for. What an automation costs beyond that in tasks and calls is in what automation really costs.

Two rules of thumb we use ourselves:

• Bundle what belongs together. One approval on a series of five similar emails, with each email visible, takes less attention than five separate requests, and the reviewer sees how they fit together.
• Remove the person where they add nothing. If a reviewer has not edited or rejected a certain kind of item in months, see whether that step can move to on the loop. That frees up room for the approvals that do matter.

How does Oase Creative build in human in the loop?

We start every flow with the question from the table at the top: which step goes out, which can you undo, which is a fixed rule? That tells us where a person needs to stand, and where not. That is how we build AI systems and agentic flows for recurring work, from content and email to admin.

Where a person stands, the five questions above apply. The approval is tied to one item, it expires, it is single-use, and a no or a silence stops the flow. Not because it is on a checklist, but because we needed it in our own system first. What we wrote about AI automation applies here too: most of our own tasks deliberately run without AI, and most of those also without a person in between.

After delivery we look together, after a month, at whether the checks still work. How much gets rejected, where it stalls, which approval has quietly become unnecessary. If you want us to keep doing that, we offer it as managed automation, with pricing on request. If you are unsure which agency should build this for you, our piece on choosing an AI agency helps.

Want to know where in your work a person needs to step in, and where you can take them out? Tell us where things get stuck, and we will look together at where you can best begin.