---
title: "Human oversight of AI agents · HITL, approval gates, EU AI Act Article 14 · Agent Fieldbook"
url: https://agentfieldbook.org/security/oversight/
description: "How much human control is kept over an AI agent. The oversight spectrum from human-in-the-loop approval to autonomous-with-audit, the runtime approval patterns that implement it, and the alignment corpora that train escalation behaviour. Grounded in NIST AI RMF and EU AI Act Article 14. A source-graded field book."
section: "Security · Human Oversight"
source: Agent Fieldbook — generated from the published page
---

# Infer, confirm, execute

**HITL · HOTL · Out-of-loop**

The spectrum of human control over an agent, from approving every action to auditing after the fact, and the runtime patterns that implement it. The Scalarity CCD topology lives here: the **Confirm** turn is the oversight gate. Grounded in NIST AI RMF and EU AI Act Article 14.

## ◀ Human control Agent autonomy ▶

## Runtime approval patterns · 6 · how oversight is actually implemented

| Pattern | Mode | Mechanism | Example | src |
| --- | --- | --- | --- | --- |
| **Confirmation gate** | HITL | The agent proposes an action as a structured call; a dedicated human approve/deny turn gates the write before it fires. The safety gate lives in the deterministic dispatch path, not in the model. | Claude Code permissions· Aport pre-action authz· Scalarity CCD Confirm turn | [↗ T1](https://docs.anthropic.com/en/docs/claude-code/security) |
| **Threshold escalation** | HOTL | The agent resolves routine cases autonomously and escalates low-confidence or high-risk ones to a human. A confidence or risk score decides the route. | Support pods· fraud-review queues· tiered resolution agents | [↗ T2](https://www.nist.gov/itl/ai-risk-management-framework) |
| **Dual control (four-eyes)** | HITL | Two independent approvers are required before a high-blast-radius action executes. Neither the agent nor any single human can act alone. | Payment release· production deploys· privileged-access grants | [↗ T1](https://csrc.nist.gov/glossary/term/separation_of_duty) |
| **Tripwire / circuit-breaker** | HOTL | An anomaly signal automatically halts the agent; a human investigates and resumes. Fail-safe by default rather than fail-open. | Egress-spike halt· spend-cap breaker· rate-limit kill switch | [↗ T2](https://www.nist.gov/itl/ai-risk-management-framework) |
| **Sampled review** | Out-of-loop | A human audits a sampled percentage of autonomous actions; an eval owner holds the quality bar. Oversight cost scales sub-linearly with volume. | QA sampling on tier-1 resolutions· eval-owner spot checks | [↗ T2](https://inspect.aisi.org.uk/) |
| **Interrupt & steer** | HOTL | The human can pause, correct or redirect the agent mid-task without restarting it. Steering rather than gating; keeps the human in control of a long-running run. | LangGraph interrupts· human steering of long agent runs | [↗ T1](https://langchain-ai.github.io/langgraph/concepts/human_in_the_loop/) |

## Alignment corpora · 80 · the datasets that train models when to escalate Live data

| Dataset | Author | Downloads | What it is | src |
| --- | --- | --- | --- | --- |
| **hh-rlhf** | Anthropic | 29814 | Dataset Card for HH-RLHF Dataset Summary This repository provides access to two different kinds of data: Human preference data about helpfulness and | [↗ T1](https://huggingface.co/datasets/Anthropic/hh-rlhf) |
| **BeaverTails** | PKU-Alignment | 18978 | Dataset Card for BeaverTails BeaverTails is an AI safety-focused collection comprising a series of datasets. This repository includes human-labeled d | [↗ T1](https://huggingface.co/datasets/PKU-Alignment/BeaverTails) |
| **oasst1** | OpenAssistant | 16342 | OpenAssistant Conversations Dataset (OASST1) Dataset Summary In an effort to democratize research on large-scale alignment, we release OpenAssistant | [↗ T1](https://huggingface.co/datasets/OpenAssistant/oasst1) |
| **PKU-SafeRLHF** | PKU-Alignment | 14391 | Dataset Card for PKU-SafeRLHF Warning: this dataset contains data that may be offensive or harmful. The data are intended for research purposes, espe | [↗ T1](https://huggingface.co/datasets/PKU-Alignment/PKU-SafeRLHF) |
| **stack-exchange-preferences** | HuggingFaceH4 | 12434 | Dataset Card for H4 Stack Exchange Preferences Dataset Dataset Summary This dataset contains questions and answers from the Stack Overflow Data Dump | [↗ T1](https://huggingface.co/datasets/HuggingFaceH4/stack-exchange-preferences) |
| **ultrafeedback-binarized-preferences-cleaned** | argilla | 11789 | UltraFeedback - Binarized using the Average of Preference Ratings (Cleaned) This dataset represents a new iteration on top of argilla/ultrafeedback-b | [↗ T1](https://huggingface.co/datasets/argilla/ultrafeedback-binarized-preferences-cleaned) |
| **PKU-SafeRLHF-10K** | PKU-Alignment | 4455 | Paper You can find more information in our paper. Dataset Paper: https://arxiv.org/abs/2307.04657 | [↗ T1](https://huggingface.co/datasets/PKU-Alignment/PKU-SafeRLHF-10K) |
| **distilabel-math-preference-dpo** | argilla | 2330 | Dataset Card for "distilabel-math-preference-dpo" More Information needed | [↗ T1](https://huggingface.co/datasets/argilla/distilabel-math-preference-dpo) |
| **PKU-SafeRLHF-30K** | PKU-Alignment | 1852 | Dataset Card for PKU-SafeRLHF Warning: this dataset contains data that may be offensive or harmful. The data are intended for research purposes, espe | [↗ T1](https://huggingface.co/datasets/PKU-Alignment/PKU-SafeRLHF-30K) |
| **alignment-research-dataset** | StampyAI | 1393 | The AI Alignment Research Dataset is a collection of documents related to AI Alignment and Safety from various books, research papers, and alignment r | [↗ T1](https://huggingface.co/datasets/StampyAI/alignment-research-dataset) |
| **hh-rlhf-49k-ja-single-turn** | kunishou | 1126 | This dataset was created by automatically translating part of "Anthropic/hh-rlhf" into Japanese, and selected for single turn conversations.You can us | [↗ T1](https://huggingface.co/datasets/kunishou/hh-rlhf-49k-ja-single-turn) |
| **preference-test-sets** | allenai | 1076 | Preference Test Sets Very few preference datasets have heldout test sets for validation of reward model accuracy results. In this dataset, we curate | [↗ T1](https://huggingface.co/datasets/allenai/preference-test-sets) |
| **aya_redteaming** | CohereLabs | 1025 | Dataset Card for Aya Red-teaming Dataset Details The Aya Red-teaming dataset is a human-annotated multilingual red-teaming dataset consisting of harm | [↗ T1](https://huggingface.co/datasets/CohereLabs/aya_redteaming) |
| **stack-exchange-preferences-code** | P1ayer-1 | 941 | Dataset Card for "stack-exchange-preferences-code" More Information needed | [↗ T1](https://huggingface.co/datasets/P1ayer-1/stack-exchange-preferences-code) |
| **gretel-safety-alignment-en-v1** | gretelai | 867 | Gretel Synthetic Safety Alignment Dataset This dataset is a synthetically generated collection of prompt-response-safe_response triplets that can be | [↗ T1](https://huggingface.co/datasets/gretelai/gretel-safety-alignment-en-v1) |
| **full-hh-rlhf** | Dahoas | 863 | Dataset Card for "full-hh-rlhf" Anthropic's HH dataset reformatted into prompt, chosen, rejected samples. | [↗ T1](https://huggingface.co/datasets/Dahoas/full-hh-rlhf) |
| **BeaverTails-Evaluation** | PKU-Alignment | 737 | Dataset Card for BeaverTails-Evaluation BeaverTails is an AI safety-focused collection comprising a series of datasets. This repository contains test | [↗ T1](https://huggingface.co/datasets/PKU-Alignment/BeaverTails-Evaluation) |
| **hhh_alignment** | HuggingFaceH4 | 711 | This task evaluates language models on alignment, broken down into categories of helpfulness, honesty/accuracy, harmlessness, and other. The evaluatio | [↗ T1](https://huggingface.co/datasets/HuggingFaceH4/hhh_alignment) |
| **stack-exchange-preferences-code-v2** | P1ayer-1 | 618 | Dataset Card for "stack-exchange-preferences-code-v2" More Information needed | [↗ T1](https://huggingface.co/datasets/P1ayer-1/stack-exchange-preferences-code-v2) |
| **TDC23-RedTeaming** | walledai | 547 | TDC 2023 (LLM Edition) - Red Teaming Track This is the combined dev and test set from the Red Teaming Track of TDC 2023. Citation If find this datase | [↗ T1](https://huggingface.co/datasets/walledai/TDC23-RedTeaming) |
| **RedTeamingVLM** | MMInstruction | 540 | Red Teaming Viusal Language Models | [↗ T1](https://huggingface.co/datasets/MMInstruction/RedTeamingVLM) |
| **lora-fusing-preferences** | multimodalart | 488 |  | [↗ T1](https://huggingface.co/datasets/multimodalart/lora-fusing-preferences) |
| **policy-alignment-verification-dataset** | nace-ai | 449 | Policy Alignment Verification Dataset 🌐 NAVI's Ecosystem 🌐 🌍 NAVI Platform – Dive into NAVI's full capabilities and explore how it ensures policy | [↗ T1](https://huggingface.co/datasets/nace-ai/policy-alignment-verification-dataset) |
| **sentence_alignment_dataset-Sinhala-Tamil-English** | NLPC-UOM | 438 | Dataset summary This is a gold-standard benchmark dataset for sentence alignment, between Sinhala-English-Tamil languages. Data had been crawled from | [↗ T1](https://huggingface.co/datasets/NLPC-UOM/sentence_alignment_dataset-Sinhala-Tamil-English) |
| **Skywork-Reward-Preference-80K-v0.2** | Skywork | 431 | Skywork Reward Preference 80K IMPORTANT: This dataset is the decontaminated version of Skywork-Reward-Preference-80K-v0.1. We removed 4,957 pairs fro | [↗ T1](https://huggingface.co/datasets/Skywork/Skywork-Reward-Preference-80K-v0.2) |
| **dolly_hhrlhf** | mosaicml | 356 | Dataset Card for "dolly_hhrlhf" This dataset is a combination of Databrick's dolly-15k dataset and a filtered subset of Anthropic's HH-RLHF. It also | [↗ T1](https://huggingface.co/datasets/mosaicml/dolly_hhrlhf) |
| **WritingPrompts_preferences** | euclaise | 328 | Dataset Card for "WritingPrompts_preferences" Human preference data from r/WritingPrompts | [↗ T1](https://huggingface.co/datasets/euclaise/WritingPrompts_preferences) |
| **text-2-image-Rich-Human-Feedback** | Rapidata | 326 | Building upon Google's research Rich Human Feedback for Text-to-Image Generation we have collected over 1.5 million responses from 152'684 individual | [↗ T1](https://huggingface.co/datasets/Rapidata/text-2-image-Rich-Human-Feedback) |
| **ultrafeedback-binarized-preferences** | argilla | 307 | Ultrafeedback binarized dataset using the mean of preference ratings Introduction This dataset contains the result of curation work performed by Argi | [↗ T1](https://huggingface.co/datasets/argilla/ultrafeedback-binarized-preferences) |
| **stack-exchange-preferences-20230914-clean-anonymization** | bigcode | 282 | Dataset Card for "stack-exchange-preferences-20230914-clean-anonymization" More Information needed | [↗ T1](https://huggingface.co/datasets/bigcode/stack-exchange-preferences-20230914-clean-anonymization) |

## Field notes

The spectrum from approving every action to auditing after the fact

Human oversight is not a new idea. Most businesses already route decisions through a second pair of eyes, scaled to how much risk or capital is exposed, and agents inherit that logic rather than replacing it.

Two things make it necessary here. Agents are probabilistic, so the same input does not reliably produce the same action, and they are not yet good enough to be trusted with consequences unsupervised. The more important one is accountability: when something goes wrong a person has to answer for it, and that only holds if a person was positioned to intervene. The modes below are just where that person stands relative to the loop.

- [Brandon Chaplin](https://www.linkedin.com/in/brandon-chaplin-digital-marketing-strategist)

## Common questions

### What is human-in-the-loop AI?

A person approves each consequential action before the agent executes it. Nothing that writes, sends or spends happens without an explicit yes. It is the tightest form of oversight and the slowest, so it is usually reserved for actions that cannot be undone.

### What is the difference between human-in-the-loop and human-on-the-loop?

In-the-loop puts the person on the critical path: the agent waits for approval. On-the-loop takes them off it: the agent acts, a human monitors and can intervene or halt it. In-the-loop maximises control, on-the-loop maximises throughput. Most production setups mix the two and tier by consequence.

### How much human oversight does an AI agent need?

It scales with what the action can break. Irreversible or high-value actions such as payments, deletions and outbound messages get an explicit approval gate. Routine, reversible work gets sampled review after the fact. Reviewing everything is slow and expensive; reviewing nothing means you hear about failures from the customer.

### How does an AI approval gate actually work?

The agent proposes an action as a structured call, a human approves or denies it, and the action then fires from that approved state. The detail that matters is where the check lives: in the code path, not in the prompt, so it is not something the model can talk its way past.

### Does the law require human oversight of AI?

For some systems, yes. The EU AI Act requires that high-risk systems be designed so a person can understand, monitor and intervene, which is Article 14. In the US the NIST AI Risk Management Framework sets out oversight as a governance function, though it is voluntary rather than binding [(NIST)](https://www.nist.gov/itl/ai-risk-management-framework).

### How does a model learn when to ask a human?

From training data. Alignment corpora are datasets of preferred behaviour that teach a model when to refuse, defer or hand a case to a person rather than push on. That escalation behaviour is what on-the-loop oversight depends on: if the model never flags the uncertain case, nobody is actually watching it.

## Next in the learning path

- [Governance The control plane the approval gate lives in](https://agentfieldbook.org/security/governance/)

- [Standards NIST AI RMF and EU AI Act Article 14 in full](https://agentfieldbook.org/security/standards/)

- [Auth & secrets What a confirmed action is allowed to touch](https://agentfieldbook.org/security/auth/)

- [Incident log The HITL failures oversight is meant to catch](https://agentfieldbook.org/security/incidents/)