A human in the loop AI agent asks a person to approve an action before it happens, but only for actions where a mistake is costly, hard to undo or legally sensitive. In customer service, answering an FAQ or changing an address can run alone, a refund above your limit needs approval, and deleting a customer’s data should never be the agent’s call.
In short
- Decide autonomy per action, not per agent: the same AI agent can answer alone, refund within a limit and hand over an account closure.
- Score each action on four consequences (reversibility, money, legal or compliance, customer harm) from 0 to 3, and let the highest score set the tier.
- Five tiers cover support work: inform (answer only), act alone, act within a limit, act with approval, never.
- An approval is a control only if the approver sees the right facts, answers in time and sometimes says no.
- Widen or narrow autonomy one intent at a time, on evidence: scored conversations, reversals and audited approvals.
What does human in the loop mean for an AI agent?
Human in the loop means a person must approve, edit or reject an AI agent’s proposed action before it is carried out. Human on the loop means the agent acts and a person monitors and can step in afterwards. Customer service needs both: in the loop for the few risky actions, on the loop for everything else.
Most guides treat the human as one checkpoint for the whole agent. In support that fails both ways: a loop on every action buries team leads in approvals, and a loop on none lets the agent cancel a subscription immediately when the customer only wanted to stop auto-renewal.
Agent platforms build the mechanism for you. Microsoft’s Agent Framework, for example, pauses a workflow and emits an approval request when the agent tries to call a tool marked as needing approval, then resumes when a response comes back (Microsoft Learn). What the platform does not decide is which actions get that flag. That decision belongs to the Head of CX, the AI agent owner and the policy owners.
OWASP calls the failure this prevents “excessive agency” and lists, among its mitigations, human-in-the-loop control “to require a human to approve high-impact actions before they are taken” (OWASP LLM06:2025). The hard part is defining “high-impact” for your own support actions. Our AI agent governance guide sets out 15 controls; this article goes deeper on control 5 (action tiers) and controls 6 and 7 (approvals and the oversight of approvers).
What are the five autonomy tiers for AI agent actions?
The five tiers are: 0, inform (answer from approved content only); 1, act alone on reversible actions with no money; 2, act within a limit on money or commitments; 3, act with a person’s approval; 4, never act, hand over. Each action sits in exactly one tier.
| Tier | The agent may | Human role | Typical control |
|---|---|---|---|
| 0. Inform | Answer from approved content, change nothing | On the loop | Conversation review against your scorecard |
| 1. Act alone | Take reversible actions with no money involved | On the loop | Action logged, conversations reviewed |
| 2. Act within a limit | Take actions with money or commitments up to a set threshold | On the loop | Threshold enforced by the platform, every case reviewed |
| 3. Act with approval | Propose the action, a person approves before it runs | In the loop | Approval log, override rate, review time |
| 4. Never | Recognize the case and hand over with context | Person owns the case | Handover quality checked |
These are the same tiers as in the governance guide, so one matrix serves your governance record and your platform configuration. The guardrails then enforce the limits inside each tier.
How do you decide which AI agent actions need human approval?
Score each action on four consequences, from 0 (none) to 3 (severe): reversibility, money, legal or compliance exposure, and customer harm if the action is wrong. The highest single score sets the tier, not the total, because a cheap action that cannot be undone is still an action that cannot be undone.
This follows the logic of Singapore’s Model AI Governance Framework for Agentic AI, which says organizations should define checkpoints that require human approval for high-stakes actions, irreversible actions (its examples include permanently deleting data and making payments), outlier behavior and limits users set themselves (IMDA, version 1.5, section 2.2.2; see our summary of the framework). Support leads put it simply: automate by consequence, not by how complex the conversation looks. The scale below makes that repeatable, so two people scoring the same action get the same answer.
The consequence scale
| Score | Reversibility | Money | Legal or compliance | Customer harm if wrong |
|---|---|---|---|---|
| 0 | Nothing changes, or the customer can undo it alone | None | None | None |
| 1 | Staff can undo it within a day at no cost | At or below your per-action limit (L1) | Follows a written policy, no regulated process | Inconvenience, fixed on the next contact |
| 2 | Can be undone, but the customer notices or it costs effort or money | Above L1, up to your approval ceiling (L2) | Touches a regulated process, a deadline or contract terms | Loss of service, access or money the customer has to chase |
| 3 | Cannot be undone | Above L2, or no fixed amount | Legal effect on the customer, or a process your company assigns to a named team (privacy, legal, fraud) | Serious or lasting harm, including to a vulnerable customer |
The scoring rule
Apply the rules in this order and stop at the first that matches:
- The action changes nothing (it only answers): tier 0, inform.
- Legal or customer harm scores 3: tier 4, never. A person who owns that process takes the case.
- Any dimension scores 2 or 3: tier 3, act with approval.
- Money scores 1: tier 2, act within a limit.
- Everything else (all scores 0 or 1, no money): tier 1, act alone.
Then apply three context overrides, whatever the action’s tier. If identity is not verified, the agent may not act on the account at all. If the customer shows signs of vulnerability, mentions legal action or files a formal complaint, the conversation goes to a person (tier 4). If the request is unusual for this customer, such as a third refund in a month, it moves up one tier. That last one is IMDA’s “outlier” checkpoint in support terms.
Which support actions need human approval? The autonomy matrix
Address changes and turning off auto-renewal can run alone; small refunds, fee waivers and goodwill credits run within a limit; larger refunds, immediate cancellations and account closures need approval; data deletion and bank detail changes stay with a person.
The limits (L1 = $50, L2 = $250) and scores below are an illustration for a subscription and e-commerce team. Copy the columns, not the numbers.
| Action | Reversibility | Money | Legal | Harm | Tier | Why |
|---|---|---|---|---|---|---|
| Answer an FAQ (return window, opening hours) | 0 | 0 | 0 | 1 | 0. Inform | Changes nothing; a wrong answer is caught by conversation review |
| Change a delivery address before dispatch (verified customer) | 1 | 0 | 0 | 1 | 1. Act alone | Staff can correct it the same day |
| Cancel at end of term (turn off auto-renewal) | 1 | 0 | 1 | 1 | 1. Act alone | Customer keeps access until the term ends |
| Refund up to $50 on an eligible order | 1 | 1 | 1 | 1 | 2. Within a limit | Money, but below L1 and inside written policy |
| Waive a late fee, once in 12 months | 1 | 1 | 1 | 0 | 2. Within a limit | Small, policy-bound, easy to audit |
| Goodwill credit within the policy amount | 1 | 1 | 1 | 1 | 2. Within a limit | Same as a small refund; outside policy it becomes tier 3 |
| Refund above $50 | 1 | 2 | 1 | 1 | 3. With approval | Money above L1; above $250 it needs a more senior approver |
| Cancel immediately with a prorated refund | 2 | 1 | 1 | 2 | 3. With approval | Customer loses access now; often not what they meant |
| Close an account | 3 | 1 | 2 | 2 | 3. With approval | History and balances cannot be restored |
| Delete the customer’s personal data | 3 | 0 | 3 | 2 | 4. Never | Irreversible, and a regulated process owned by the privacy team |
| Change bank or payout details | 2 | 3 | 2 | 3 | 4. Never | Classic fraud target; harm can be large and lasting |
Define the action precisely. “Cancel subscription” is two actions with different tiers. An agent that cancels immediately when the customer asked to stop the next renewal has done the wrong action correctly.
Separate the request from the execution. The agent can accept and log a data deletion request (tier 1) while the deletion itself stays with the privacy team (tier 4). Under the GDPR, the company must tell the customer what action it took on such a request “without undue delay and in any event within one month of receipt of the request” (GDPR Article 12(3)), so a clean handover with a ticket and a deadline is the agent’s job.
Check the legal column with your own counsel. GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, with exceptions; where an exception applies, the company must offer at least the right to obtain human intervention. Whether an account closure or a refusal falls under it depends on your case, which is why the matrix sends such actions to a person. For EU-specific duties, see our guide to the EU AI Act in customer service.
How does an AI agent approval workflow work in practice?
The agent proposes the action, the platform pauses it and sends an approval card to the right person, who approves, edits or rejects within a set time, and the agent tells the customer what happens next. If no one answers in time, the action is denied and the case goes to a person.
Who approves
Route each tier 3 action to the role that already owns the decision for human agents, not to a new role.
| Action | Approver | Backup if unavailable |
|---|---|---|
| Refund between L1 and L2 | Team lead on shift | Any team lead in the queue |
| Refund above L2 | Billing or finance specialist | Hand over, no action |
| Goodwill outside policy | Team lead | Hand over, no action |
| Immediate cancellation | Retention or billing specialist | Offer end-of-term cancellation instead |
| Account closure | Account specialist | Hand over, no action |
How fast approvals need to be
Approval time should match the channel. In live chat the customer is waiting, so you need an answer in minutes or a clear message that the action will follow by email. In email and tickets a few hours is often fine. Set a target per channel and measure it.
When the deadline passes, deny by default. IMDA lists “denying action by default when approval infrastructures fail”, for example when human supervisors are unreachable, among its monitoring measures (section 2.2.2). The customer should then hear that a person will follow up, never silence.
What the approver sees
IMDA advises keeping approval requests “contextual and digestible”, short and clear rather than long logs, while making the risk clear and including useful data such as the risk of the action (section 2.2.2). For a support refund, that means one card:
- The action, amount and triggering rule (“refund $120, above the $50 limit”).
- Identity status and relevant history, such as refunds in the last 12 months.
- The policy the agent relies on, linked, with its version.
- The agent’s reason in one sentence, a two-line summary and a transcript link.
- The consequence scores, so the approver knows what is at stake.
- Approve, edit or reject, with a reason required for edit and reject, and a written justification for approvals above L2.
Worked example: how many approvals can your team handle?
Illustration, with numbers chosen for the example. An AI agent handles 40,000 conversations a month, and 6% of them end in a tier 3 action. That is 2,400 approvals a month, or about 109 per working day over 22 days. At 90 seconds per approval, that is about 2.7 hours of team lead time every day, before anyone has read a transcript in depth.
Approvals are a staffing line, so plan them like one. If the tier 3 share grows to 15%, the same team faces about 273 approvals a day and review quality drops. That is the moment to move some actions to tier 2 with a limit, on evidence, rather than ask people to click faster.
How do you avoid approval fatigue and rubber-stamping?
Measure the approvers, not only the agent. Track each approver’s override rate (how often they edit or reject) and their review time. IMDA notes that a low override rate may signal rubber-stamping and a shorter review time may signal automation bias or review fatigue (section 2.2.2). Then audit a sample of approved actions.
Automation bias, accepting a system’s suggestion without checking it, grows when requests are almost always right. So the problem gets worse as the agent gets better.
Illustration of what the report can show, with invented numbers:
| Approver | Requests (30 days) | Edited or rejected | Override rate | Median review time |
|---|---|---|---|---|
| Team lead A | 1,200 | 20 | 1.7% | 4 seconds |
| Team lead B | 640 | 58 | 9.1% | 70 seconds |
| Team lead C | 710 | 61 | 8.6% | 65 seconds |
Team lead A is the “outlier” IMDA describes, an approver whose decision patterns deviate from the norm. Four seconds is not enough to read a card. This is not a disciplinary finding: it usually means A covers the busiest shift.
Four habits keep approvals meaningful:
- Keep tier 3 small. If an approver handles more than a set number of requests an hour, move clearly safe actions down a tier with a limit.
- Audit approved actions. Each week, have QA review a sample of approved actions against policy. An approval rate tells you nothing; a correct-approval rate does.
- Train approvers on agent failure modes, such as citing an outdated policy, which IMDA gives as an example. Our article on why AI conversations fail lists the common ones.
- Rotate and cap. Spread approvals across leads and set a cap per shift, so no one approves hundreds of requests in a row.
What evidence should widen or narrow AI agent permissions?
Widen autonomy for one intent when its scored conversations pass, its approvals are mostly correct on audit, and its actions are rarely reversed or disputed. Narrow it when any of those slip. Change one step at a time: raise a limit or move one action down a tier, then watch the next weeks.
The evidence per intent:
| Signal | What it tells you | Widen when | Narrow when |
|---|---|---|---|
| Conversation scores (accuracy, policy, escalation) | Whether the agent applies the policy correctly | Critical criteria pass consistently | A critical failure repeats |
| Override rate on approvals | How often people disagree with the agent | Low, with normal review times and clean audits | Rising, or low with very short review times |
| Audit of approved actions | Whether approvals were right | Nearly all correct | Wrong approvals found |
| Reversal rate (refunds clawed back, cancellations undone) | Whether actions held | Rare | Rising |
| Reopens and complaints after the action | Whether the customer agreed | Flat or falling | Rising |
A low override rate can mean the agent is right, or that approvers stopped reading. Only the audit and the review times separate the two, so use all three before you widen. Then widen in steps: raise L1 from $50 to $75 for refunds on one intent, keep everything else, and compare the next four weeks with the last four. The governance guide has example gates for moving an intent up a tier and a demotion rule. To check that actions did what the customer needed, see how to run an AI agent resolution audit, and keep the policies behind each limit current with AI agent policy management.
When this matrix is not for you
If your AI agent only answers questions, you are entirely in tier 0: you need a good knowledge base, a handover rule and conversation review, not an approval workflow. Build the matrix the week before you connect the agent to refunds or account changes. And with a few dozen actions a week, a team lead can read every one after the fact, so override reports add little.
Where Kaizo fits
Kaizo is QA and governance oversight for support teams where people and AI agents share the work. AutoPilot scores every resolved conversation against your own scorecard, so the conversation scores in the evidence table come from all of your conversations, not a sample, and every score links to the lines that justify it. See how QA for AI agents works.
See it on your own conversations. Kaizo scores 100% of your support conversations, from your team and your AI agents, and shows where quality breaks. Book a demo.
How to start this week
You can build the first autonomy matrix in an afternoon with your AI agent owner and one team lead, from the platform configuration, last month’s approval log and the scoring rule above.
- List every action your AI agent can take today, from the platform configuration, not from memory.
- Score each action, then apply the scoring rule and the three context overrides.
- Compare with the platform. Check that each tier 2 limit and tier 3 approval flag is enforced in the platform, not only in the prompt.
- Name the approver and the deadline for every tier 3 action, and set deny by default on timeout.
- Pull last month’s numbers: approvals per day, override rate and median review time per approver. That is your baseline for the first autonomy review.
Our guide to agentic customer service shows where these tiers fit in the wider rollout.
Frequently asked questions
What is human-in-the-loop authorization for AI agents?
It is a rule that an AI agent may not carry out certain actions until a named person approves them. The agent proposes the action, the platform pauses it, and the approver approves, edits or rejects it. The authorization is per action and per amount, not a blanket permission for the agent.
Is ChatGPT human in the loop?
On its own, a chat assistant is human in the loop in a simple sense: it produces text and a person decides what to do with it. Once it is connected to tools that take actions, such as issuing refunds, you have to decide which actions run alone and which wait for a person.
What is the purpose of a kill switch for an AI agent?
A kill switch stops an AI agent, or one of its actions, quickly when something goes wrong, such as a bad release or a policy error repeating at scale. It complements approvals: approvals stop single risky actions before they happen, and a stop mechanism limits the damage when a pattern slips through. Check what your agent platform offers to pause an agent or a single action, and who may use it.
Should refund limits be the same for every customer?
Not necessarily. Set one limit per action, then lower it or require approval for recent refunds, unverified identity or unusual requests. IMDA also mentions limits users set themselves, such as approval for purchases above an amount.
What does the AI agent tell the customer while it waits for approval?
It should say plainly that a colleague needs to confirm the action, how long that usually takes, and how the customer will hear back. It should never promise the outcome before approval: a rejected promise is worse than a short wait.
Does a human in the loop make the company less liable for AI agent mistakes?
No. An approval shows that a person checked the action, but responsibility stays with the company, and a log of rubber-stamped approvals can show that oversight was not real. Keep the approval log, override rates and audits, so you can show the checks worked.
