You Put a Human in Every Loop and Reviewed Nothing

A $12M logistics company I advise turned on an AI agent to code and route its bills this spring. The controller was careful about it. Every action the agent took, she approved. She told me it was working great. Then I pulled the approval log for one afternoon. She'd cleared 214 items in about forty minutes. That's roughly eleven seconds per item, counting the ones she stopped and actually read. Most got a glance and a click. She wasn't reviewing the agent's work. She was keeping up with it.

That's the failure mode nobody demos. You keep a human in the loop on everything, and the loop moves faster than the human can think.

A checkpoint everyone passes isn't a checkpoint

When a review step approves 99% of what crosses it, two things are true at once. The reviewer has stopped reading closely, because nothing has gone wrong in the last two hundred items and attention doesn't survive that stretch. And the one item that should get caught looks exactly like the two hundred that were fine. Uniform volume trains the reviewer to trust the stream. The exception shows up dressed as routine, and it clears at the same eleven seconds as everything else.

This is worse than no review, not equal to it. A blank approval step still produces a record that says a human looked. The audit trail shows sign-off. The board hears there's a person in the loop. Everyone believes the control is real, so nobody builds the one that would work. False assurance costs more than a known gap. A known gap gets watched.

Ask whether the review changes the outcome

The useful question isn't "should a person approve this?" It's narrower. Does a person looking at this actually change what happens next? For a recurring AWS bill that matches last month within a dollar, the answer is no. The controller approves it every time and would approve it every time. Sending it through a human adds a click and catches nothing.

A review step that never changes the outcome isn't a control. It's a receipt that says you were there.

So stop reviewing by volume and start reviewing by exception. Let the agent clear the routine on its own, inside rules you've written down, and log every action. Then pull the small set where judgment moves the result: a new payee, a bank account that changed, an amount outside the vendor's normal band, anything the agent itself flagged as low confidence. That might be six items a day instead of two hundred. Six items a controller reads slowly is a real control. Two hundred she skims is theater.

Run the math on your own setup. Take one day of approvals, divide the count by the minutes spent, and see how many seconds each decision got. If the number is in single digits, you don't have a human in the loop. You have a human next to the loop, clicking.