Human-in-the-Loop

Human-in-the-loop (HITL) is a design principle for automated and AI-driven systems in which a person reviews, approves, or can override the system's decisions — especially the consequential ones — before they take effect. In security, it is the difference between an AI agent that drafts the wire transfer and one that sends it.

How it works

The control sits at the action boundary. The automated system does the reading, drafting, and planning at machine speed, but defined categories of action — sending messages, making payments, sharing or deleting data, changing access, entering credentials — pause for explicit human confirmation. Good implementations show the human what is about to happen in plain language ("this will email the attached file to an external address") rather than a generic approve button, because a confirmation habit that rubber-stamps everything recreates the problem it was meant to solve. The pattern has a long pedigree in payment controls — callback verification before changing a supplier's bank details is human-in-the-loop for invoice fraud — and it has become the single most recommended safeguard for agentic AI, because hidden instructions that hijack an agent through prompt injection still have to get their final action past a person.

How to defend with it

Define the action categories that always require confirmation, and resist the temptation to let convenience erode the list — attackers specifically aim for the actions nobody reviews. Keep approval prompts specific, rare, and meaningful so security fatigue doesn't turn them into reflexive clicks; a system that asks for confirmation forty times an hour has no loop, just a human-shaped latch. And train the humans in the loop: an approval step only works when the person understands they are a control, knows the red flags for a manipulated request, and can decline without friction. That judgment under pressure is exactly what security awareness programs now need to build for the agent era, not just the inbox.