What Is Human-in-the-Loop?

Definition

Human-in-the-loop is the rule that names, before a process runs, which class of results the machine will not act on, which person receives them, and how that handoff is recorded.

It is not a person watching the output in the hope of noticing something wrong.

What it is not

The distinction that matters is where the person sits relative to the action, and whether that position was chosen before the run.

A human-in-the-loop is not a human-on-the-loop — on-the-loop means a person may abort an action, while in-the-loop means the run does not act until a person decides.
A human-in-the-loop is not a human-over-the-loop — over-the-loop is the role that owns the system and its policy, while in-the-loop is one written decision point inside a run.
A human-in-the-loop is not full autonomy — full autonomy acts on every result, while the loop keeps a named class of results out of the machine's hands.
A human-in-the-loop is not guardrails — guardrails are the rules a run must satisfy, while the loop is where a result leaves the automated path entirely.
A human-in-the-loop is not a review step added later — a review is a task someone may pick up, while the loop is a contract fixed before the run.

How it works

The loop is a rule before it is a handoff, and it is a record before it is a habit. None of it depends on someone noticing a problem; each step is either a written rule or a recorded event. Six things happen in order.

The boundary is written down first. The contract names the class of results the run will not act on by itself, and the marker that puts a result in that class.
The owners agree to it. The team that operates the process and the business that depends on it both accept the boundary before any run. It is not widened because a result is inconvenient.
The destination is named. The handoff has one owner defined in advance, not a channel left for someone to notice.
The reading is taken on every run. Each result is checked against the contract, and a result that falls outside it is stopped before it can write.
Crossing it is an event. The run stops, the blocker is attached, and the person receives the reason, the input, and the record behind it.
The outcome is written back. What the person decided is recorded on the run, so both the boundary and its use can be read afterwards.

Worked example

Consider a workflow that reviews incoming refund requests, checks each one against the order record, and issues the payment. During design, the people who own the process write the contract that governs it. A valid result is a request that matches an order, asks for an amount within that order, and has no earlier refund against it. Everything that passes runs unattended.

The contract also names the results the workflow will not act on by itself: a request above a stated limit, a request whose order record is missing or contradictory, and a request that carries a dispute marker. Those results are the loop. They are decided in advance, not in the moment.

When one of them arrives, the run stops before any payment is issued. The item moves to the owner named in the contract, carrying the reason it stopped, the request itself, the order record, and the history of the run. The owner approves, adjusts, or rejects it, and that decision is written back onto the run.

The record then holds both facts at once: the payment was never made without a person, and the person was asked only for the judgment the process had declined to make. Nothing in the routine path asked for a person, and nothing in the human path asked for a second machine decision. The routine volume continued unattended.

Common questions

What is human-in-the-loop?

Human-in-the-loop is a control that keeps a named class of results out of the automated path until a person has decided what to do with them. The class, the owner, and the record are fixed before the process runs. Everything outside that class continues unattended, which is what separates the loop from ordinary manual work.

What is the difference between human-in-the-loop and human-on-the-loop?

In-the-loop means the process will not act until a person decides, so the person sits in the path of that result. On-the-loop means the process acts and a person can abort or correct it afterward, so the person watches from above the path. One puts a decision before the write; the other puts a person in a position to react.

Is human-in-the-loop the same as manual review?

No. Manual review describes a task; human-in-the-loop describes a rule. In manual work a person handles a share of the volume because nothing has decided otherwise. In human-in-the-loop the routine runs unattended and only the results that fall outside the contract reach a person. What makes it the loop is that the boundary was written down before the run and is recorded on it.

When should a process stop and hand off to a person?

When the result belongs to a class the business has already said it will not act on by itself: an amount above a stated limit, a missing or contradictory record, or a case that carries legal or safety weight. The test is not how unusual the result looks in the moment but whether it belongs to the class named in advance.

Does human-in-the-loop slow down automation?

It slows only the named exception. Everything inside the contract keeps running at machine speed, and the handoff applies to the class the business has chosen not to automate. Removing the handoff does not remove the edge; it moves the discovery of that edge to after the action, when reversing it costs more.

How Opsyl implements it

In an Opsyl pipeline the handoff is a defined step, not a fallback added after an incident.

A contract first. The scope the client approves states what a valid result looks like, before any run. The handoff point is part of that scope, not a decision made in the moment.
Blocked, with the reason attached. A result that falls outside the contract is stopped before it can write, and moves to a person carrying the reason it was stopped.
A named destination. The exception routes to an owner defined in advance. It is not broadcast to a channel and left for someone to claim.
A logged reason. The block and its cause are recorded on the run, so the trail shows not only what was stopped but why.
The routine stays automatic. The human handles the edge. The pipeline handles the volume, unattended, and reports on it.

The governing claim holds at this point as much as anywhere: AI is probabilistic, our pipelines are not. Human-in-the-loop is where that claim is enforced — the moment the pipeline would otherwise be guessing, it stops and asks instead.

Where this connects

The handoff lives inside the Operating Layer, the execution layer between a decision and a system of record, and it is one of the controls that make Agent Governance real: a boundary is only a boundary if something happens when it is reached. Read next to Output-Contract Validation, it completes the picture — a contract says what counts as valid, and the human path is what happens when the answer is no.

Sources

Retrieved 2026-09-27.

Continuous assurance for AI-driven clinical decision support systems — Frontiers in Artificial Intelligence, describes oversight maintained while a deployed system runs, through escalation, recalibration, and rollback controls.
What is Human-in-the-Loop? — Stanford HAI, defines human-in-the-loop as human feedback or intervention inside a system's operation.
Human-in-the-loop — Wikipedia, records the distinction between in-the-loop, on-the-loop, and out-of-the-loop control.
Automation bias — Wikipedia, describes the tendency to favour automated suggestions and ignore contradicting information.

The commercial consequence

A business does not get an automation it can trust by removing people from it; it gets one by deciding exactly where the people stay. The first paid step with Opsyl is the Agentic Ops Audit: a fixed-scope week that maps where work actually goes and returns a written assessment of which steps can run unattended and where a handoff belongs. You keep the assessment whether or not you build.

Start with the audit →

→ Related: Operating Layer · Agent Governance