Lab instrument / Human-in-the-loop

Where does an automated action earn its authority?

A maintenance agent proposes an action. Set the facts and watch it pass — or fail — four separate checks before anything happens. Every run leaves a decision record, including the runs where the right answer was to do nothing.

A deterministic teaching model. The agent, environments and people are illustrative; nothing is changed anywhere.

The agent proposesPrepare a cleanup reportLists idle staging environments. Changes nothing.Suspend an idle environmentStops it; it can be resumed with its data intact.Delete an expired environmentRemoves it and its data. Cannot be undone.

Waiting for a person

ContractIs the request well-formed?: passed.
PermissionMay this agent do this at all?: passed.
EvidenceDo the facts support it?: passed.
PersonDoes someone own the consequence?: waiting here.
ExecuteAct, once.: not reached.
RecordCan the decision be explained later?: passed.

Prepared, then paused for a person.

Preparation was automated; the irreversible step was not. Authority ends exactly where the consequence cannot be taken back.

Decision recordDR-b5cba549

Outcome: Waiting for a person
Rules: gate-rules/2

Contract: The request has the expected shape.
Permission: The agent’s scope includes changing environments.
Evidence: The evidence is complete, consistent and independently verified.
Person: Irreversible. Everything is prepared; the step that cannot be undone waits for a named person.

The identifier is derived from the facts and the rule version. Change any fact and it changes; restore it and the same record returns.

Set the facts

The request

Well-formed requestThe proposed action matches the expected schema.Agent holds write scopeIts credential may change environments, not only read them.

The evidence

Evidence completeOwner, last activity and expiry date are all present.Evidence independently verifiedActivity was confirmed from a second source, not only the agent’s own reading.Conflicting evidenceSomething says the environment is still in use.

The person

A person approvedA named owner confirmed this specific action.

Four questions that must not be merged

Shape is not permission

Validation answers whether a request is well-formed. It says nothing about whether the caller may make it. Turn off write scope with a perfectly valid deletion: the request is stopped at permission, before any evidence is considered. Collapsing the two checks into one “is this OK?” function hides which one failed — and which fix is needed.

Assurance proportional to consequence

A suspension can proceed on complete but unverified evidence, because it can be undone. A deletion cannot, so it needs evidence confirmed from a second source and a named person. The rule is not “always ask a human”; it is that authority ends where the consequence can no longer be taken back.

Asking is an outcome

When evidence is missing or contradictory, the agent returns the request instead of choosing. Conflicts go to a person with both sides shown. A system that always produces an answer is not more capable — it has simply moved the uncertainty somewhere it can no longer be seen.

The record is part of the decision

Each run produces a record with its reasons and the rule version. Its identifier is a digest of the facts and the rules: the same facts produce the same record, so a decision can be reproduced and challenged months later. Note the unused write scope on the report action — excess authority is visible in the record even when nothing goes wrong.

Sources and further reading

LLM06:2025 Excessive AgencyOWASP Gen AI Security Project
Authorization Cheat SheetOWASP Cheat Sheet Series
Input Validation Cheat SheetOWASP Cheat Sheet Series
Artificial Intelligence Risk Management Framework (AI RMF 1.0)NIST AI 100-1, 2023

Let’s make a connection.

Working on something in automation & integration? The contact form will start with that topic selected.

Discuss this challenge