Human in the loop means an AI system stops at a defined point, and a person checks, approves or rejects before anything happens. With human on the loop, the system acts on its own; a person shapes it during design, monitors its operation and steps in when needed. For AI agents there are four patterns: approval before any outside action, sampling, escalation when unclear, and a separate reviewer role. The approval belongs in the tool, not the prompt: Claude Code asks through ask rules, n8n pauses an agent before selected tools. The EU AI Act requires human oversight only for high-risk systems, for most of them from December 2, 2027.
I run my business with an AI workforce of my own, each employee with their own role, their own personnel file and their own limits. Technical and legal details: vendor docs and the law itself, as of November 4, 2026. I collect everything on agents on the AI agents page.
Human in the loop: meaning and definition
A good working definition comes from the 2019 Ethics Guidelines of the European Commission's AI expert group, which distinguish three forms of oversight. Human in the loop there "refers to the capability for human intervention in every decision cycle of the system", with the notable addition that this "in many cases is neither possible nor desirable".
The fourth row is colloquial, not from the guidelines. The practical part is the closing sentence: "All other things being equal, the less oversight a human can exercise over an AI system, the more extensive testing and stricter governance is required."
Human in the loop vs human on the loop
The choice depends less on the model than on whether a mistake can be taken back. An email to a client, a published text, a paid invoice: once it is out, it is out. That is where the person belongs in the loop. A sorted inbox, an internal report, a draft: a mistake shows up when you look. Human on the loop is enough there.
Where the line between establishing and deciding runs is in What Can an AI Lead Role Decide?. Here it is about building it in.
Four patterns for AI agents
1. Approval before the action. The agent prepares everything; the last step with an outside effect waits for a yes. The strictest form, right for anything that costs money, leaves the house or makes a promise. What matters is how approval is recognized. "Looks good" is an opinion, not an instruction.
2. Sampling. The agent acts on its own, and a person checks a fixed share of the results afterwards. This is human on the loop with a method, for high-volume tasks with reversible mistakes. Decide beforehand what counts as a mistake and when the task falls back to approval.
3. Escalation when unclear. The agent handles standard cases itself and hands everything that does not clearly fit back to a person. That only works if "not clearly" is described beforehand.
4. A separate reviewer role. Before a result reaches the person, a second instance that did not create it checks it. It is the four-eyes principle applied to agents. It does not replace approval, but the person no longer has to find every typo. How one AI checks another AI's work is in LLM as a Judge: How AI Checks AI Work.
Building it in: approval in the tool, not in the prompt
"Ask me before sending" in a prompt is a request to the model. Human in the loop only becomes reliable when the tool itself stops.
Claude Code has three kinds of permission rules, according to Anthropic: allow rules run without asking, ask rules prompt every time, deny rules block. They are evaluated in the order deny, ask, allow, so a matching ask rule prompts even if a narrower allow rule matches too. The key sentence in the docs: "Permission rules are enforced by Claude Code, not by the model." An example for the settings file:
{
"permissions": {
"ask": ["Bash(git push *)"],
"deny": ["Read(./.env)"]
}
}
In Manual mode, Claude Code stops before most actions that edit files, run shell commands or reach the network. In auto mode, according to the docs, a second model reviews actions "instead of you". That is the step from in the loop to on the loop; per Anthropic it reduces prompts without guaranteeing safety, and ask rules still prompt. Since v2.1.283, interactive terminal and VS Code sessions start in auto by default, per the docs; for human in the loop, set permissions.defaultMode to default (Manual) or add ask rules. For unattended runs with claude -p, since version 2.1.302: anything that would need approval is denied unless an allow rule, a hook or an approval tool permits it. The details are in Claude Code Security: Permissions and Sandbox.
n8n has its own approval step for AI agents. In an AI Agent node's Tools panel you add a "Human review" section and attach the tools that may only run with consent. When the agent wants one, the workflow pauses and sends a request via Slack, Microsoft Teams, Telegram, Gmail or similar. The person sees tool and parameters and picks Approve or Deny; on Deny nothing runs, and the agent is told. n8n recommends stating in the system prompt which tools need approval and how to handle a no. Without an agent, the Wait node pauses until a webhook call or form submission arrives. What I learned building an agent with n8n is in n8n AI Agent: What I Learned Building One. Building a workflow step by step is covered in n8n Workflow Tutorial: Build, Test, Export.
How it works at my place
In my business, a split into three levels has proven itself. Level 3 is "only with approval": money, anything that leaves the house, contracts, promises and judgements with no rule. Here the employee only prepares. "Get it done" is not a sign-off; only a clear "send it" or "put it online" counts, logged with the exact wording and time.
Day to day: Sonja writes emails in my voice and drops them as drafts into my inbox; nothing goes out until I say so explicitly (Sonja). Frieda sorts the inbox into four piles plus a fifth pile for cases that need my judgment, and she has never sent anything on her own: every reply stays a draft until I approve it (Frieda). That fifth pile is escalation when unclear in its simplest form. Anton creates offers and invoices as drafts and never finalizes on his own; even if pushed, he first names the consequences and wants a clear yes from me (Anton).
On top of that: author and reviewer are never the same instance. On July 20 the review pass caught "for a few weeks now" in a draft by Conny, when it had been four days. And whatever an employee must not do, I block technically instead of only writing it into the working instructions.
Human in the loop in the EU AI Act
This is not legal advice, but an operator's perspective. The EU AI Act, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, covers human oversight in Article 14, and only for high-risk AI systems. They must be built so that natural persons can oversee them effectively in use: understand their limitations, stay aware of "automation bias", disregard or reverse the output, and halt the system with a "stop" button or similar procedure. Article 26(2) requires deployers to assign human oversight to natural persons "who have the necessary competence, training and authority".
Two limits matter. First, this applies only to high-risk systems, for example Annex III systems in employment or creditworthiness checks. An agent that drafts your emails is not one of them. Second, under the amended Article 113 these obligations apply only from December 2, 2027 for systems under Annex III and from August 2, 2028 for systems under Annex I. All deadlines are covered in EU AI Act: Overview and Deadlines 2026.
Separately, Article 22 GDPR applies: in principle, nobody has to be subject to a decision "based solely on automated processing" that produces legal effects concerning them or similarly significantly affects them. A person who confirms without looking is no reliable answer to that. If job applications, loans or dismissals are involved, have the setup checked by someone liable for it.
Frequently asked questions
What does human in the loop mean?
A person can intervene in every run of an AI system before the result takes effect. The EU ethics guidelines call it the capability for human intervention in every decision cycle.
What is the difference between human in the loop and human on the loop?
In the loop, the system waits for the person before acting. On the loop, it acts and the person monitors and steps in. The first fits irreversible actions, the second reversible mistakes.
Is human in the loop required by law?
For high-risk AI systems, Article 14 of the EU AI Act requires human oversight, for systems under Annex III from December 2, 2027. For decisions about people based solely on automated processing with legal effect, Article 22 GDPR applies. For an agent that only writes drafts, neither creates such a duty. This is not legal advice.
Is it enough if someone clicks "approve"?
Only if they actually check first. The AI Act names the risk: automation bias. A clear approval wording, a reviewer before the person and a request showing exactly what will happen all help.
When can I skip human in the loop?
For tasks that are verifiably right or wrong and change no state, such as checking, sorting or drafting. Sampling or escalation is enough there. As soon as money, an outside effect or a promise is involved, the person stays in the loop.
What to do next
Take your agent and write one line for every tool it may use: free, sampled, approval or never. Then put everything marked "approval" into your tool as an ask rule or a human review step, not into the prompt. How others draw their approval lines, we discuss in my community AI Employee Framework.
