Three places to put the person
“Human in the loop” is usually described as one thing. In production it is at least three, and they differ in what the person sees and how often:
- Below a threshold, per item. The agent handles what it is sure of; a person checks what it is not. The person sees a small share of items, each with the evidence beside it.
- Before a write, per decision. The agent may read everything and change nothing that matters. It brings findings and a proposal; a person approves the action.
- Before it is seen, per output. The agent produces finished work, checked by code, and a person signs it off before anyone else can see it.
Behind all three sits a fourth, which is easy to forget because nobody clicks anything: the people who decided what a correct answer is. An evaluation set labelled by people, re-run on every change, is a human in the loop at release time rather than at run time.
A confidence threshold: the logistics platform
On the enterprise AI analytics platform we built, the model reads documents from 14 sources in 5 languages, extracts values and validates them against approved reference material and routing rules. Every value carries a confidence score. Values below the threshold go to an analyst review workspace with the source highlighted, and every decision there is kept in an audit trail. After all the improvements, about 4% of fields are routed there.
That is how 87% less manual processing and human control live in the same system: the analysts’ work moved from keying values to checking the small share the model is unsure of, with the source beside it. Approval checkpoints for edge cases and exceptions stay in place before validated values reach the client’s ERP.
The threshold is a business decision as much as a technical one. Set it lower and more values reach people, so review costs more. Set it higher and more errors go through unseen. What makes the choice measurable is the golden dataset: about 2,000 documents labelled by our engineers together with the client’s analysts, which shows the accuracy of the values above the threshold and of those below it. It is re-run on every change to prompts, models or the pipeline, and a drop below the accuracy threshold blocks the release. The whole method is in RAG evaluation before production.
Read everything, write a note: the analytics board
Day-to-day search and content work for three small businesses of ours is done by AI agents. They work from one analytics board, which is also an MCP server, and the boundary is drawn in the tools rather than in a prompt. Agents get fourteen tools that read and one that writes, and the one write is a journal note recording what changed and when. The board’s SQL tool is read-only in four separate ways, and nothing an agent can call changes a site, a lead or a campaign.
The rule around the tools is report first. An agent brings findings and a proposal, and a site is edited only after the owner says yes. An edit is prepared as a diff in the site’s repository, and committing, pushing and deploying each need a separate yes. There is no write access to the ad accounts at all, so ad changes come back as ready-to-paste lists. Even the note waits: it is written after a deploy, not after a suggestion, and in the review that measures impact the agent proposes it and writes it only after the owner agrees.
One more line keeps the person in charge here: everything the board returns is declared data, not instructions. Search queries, page titles and ad phrases are partly written by strangers, so anything in them that reads like a request is shown to the owner as a finding rather than carried out. How the server is built is in a read-only MCP server for business data.
A person on Publish: the draft writer
Two of the same businesses’ blogs get their drafts from a 4B model running on a mini PC on our own network. Here the person sits at the end, and code does the checking before them. The writer refuses to start without fact records for a topic. Code picks the topic and inserts the links. Eleven checks that use no model — length, similarity to published articles, stock phrases, links, structure and grounding — gate every draft, and a draft that fails is never shown to anyone.
A draft that passes arrives in a chat as a card with two buttons, Publish and Reject, or on a private review page. The daily schedule only produces drafts. Whether the content is true is a person’s call, and the writer never publishes by itself. The checks are arithmetic rather than a second model on purpose: a second model judging the first would share its blind spots. The full pipeline is in a self-hosted LLM writes our blog drafts.
What the agent does alone, and what a person confirms
| System | The agent does alone | A person confirms |
|---|---|---|
| Logistics platform | Reads documents, extracts values, validates them against reference material, passes values above the threshold on | About 4% of fields, below the threshold, with the source highlighted; edge cases and exceptions before the ERP; the labels that define a correct answer |
| Analytics board | Reads all of the board through fourteen tools and read-only SQL, compares periods, writes a report and a proposal | Every change to a site, with a separate yes to commit, push and deploy; the journal note; every ad change, pasted by a person |
| Draft writer | Turns the section code chose into a topic, then a plan and sections, from facts chosen by code; eleven checks run on the result | Publish or Reject, on every draft |
Across all three, the pattern is the same. The agent gets the reading, the drafting and the proposing, which are cheap to redo. A person keeps the writes that are expensive to undo. The automation’s job is to make that person’s step quick, not to remove it.
What we have not published
All three are agents with a narrow tool set and a human checkpoint, and that is the shape we think most production agents should start as. We have not published a case study of an open-ended autonomous agent, and nothing here implies one. When we build an agent for you, the evaluation set is what decides how much autonomy it earns, and the line between what it does alone and what a person confirms can move as the numbers earn it.
Where to start is usually a single workflow. One agent workflow added to a product you already run is quoted in our AI agent development work against the $15,000–$30,000 band over 2–4 weeks, at a fixed price against a written scope.