Human-in-the-loop for irreversible actions

One-way doors (a payment, a deletion, sending an email to a customer) require confirmation; two-way doors (a draft, a search) do not. This is the reversible/irreversible decisions principle (20) applied to agents.

sealed interface AgentAction permits Draft, Search, Irreversible {}
record Irreversible(Action a, Justification j) implements AgentAction {}

// pipeline: Irreversible goes to the approval queue; Draft/Search run immediately

The reason for the gate is asymmetric cost. An agent that drafts a wrong reply costs a minute of editing; one that sends a wrong refund, drops a table or emails every customer costs what cannot be taken back, and agents can be steered by what they read (49). Making the action a type, as above, means the executor cannot reach the irreversible path without an approval object — the gate lives in the code, not in a prompt asking the model to be careful.

The weak point is the human. Parasuraman and Riley, “Humans and Automation: Use, Misuse, Disuse, Abuse” (Human Factors, 1997), describe how people over-trust automation that is usually right and stop checking it; Bainbridge’s “Ironies of Automation” (1983) adds that monitoring rare failures is a task humans do badly. An approval queue where 99% of items are fine trains its reviewers to click “approve”. So the request must show what matters for the decision — the diff of the state, the amount, the recipients, the agent’s stated reason — not a log of its reasoning.

A single reversibility criterion leads to rubber-stamping: when there are too many approvals, people stop reading them. The threshold is made up of reversibility, scale of impact, the initiator's authority, and uncertainty. And an approval must be bound to the hash of a specific immutable action — otherwise a TOCTOU gap (time-of-check to time-of-use) remains between “shown for approval” and “executed”.

Make doors two-way where you can. A delayed send with an undo window, a soft delete with a retention period, a refund capped per day: each moves an action out of the approval queue and keeps human attention for the few that need it.