Human-in-the-loop is a design decision, not a disclaimer

"A human reviews the output" appears in almost every enterprise AI architecture diagram, usually as the last box before done. It reads as safety. In practice it's often theatre: by the time a reviewer sees a finished artifact, rejecting it means redoing everything upstream, so approval rates trend toward 100% regardless of quality.

The problem isn't the human. It's the placement.

Gate the decision, not the artifact

Inside any multi-step workflow there is usually one step where judgement genuinely matters — the liability clause changed, the payout exceeds the threshold, the customer is on a watchlist. That is where the gate belongs:

steps:
  - id: extract-terms
    kind: model
    budget: { tokens: 8000 }
  - id: legal-gate
    kind: approval
    owner: legal-oncall
    context: [terms.diff, risk.summary]
    timeout: 4h
  - id: write-back
    kind: connector
    idempotent: true

A gate placed mid-run can actually change the outcome cheaply: reject at legal-gate and only the downstream steps are discarded. And the run holds — durable state means "waiting for a human" is a first-class status, not a lost thread in someone's inbox.

Context is what makes review real

A reviewer shown a wall of text will skim. A reviewer shown a diff against the last approved run plus a one-line risk summary makes a genuine decision in seconds. When we shipped structured context on gates, median approval turnaround across our fleet fell from 3m 40s to 38 seconds — not because people got faster at reading, but because we stopped asking them to read the wrong thing.

Three properties make a gate honest:

• The reviewer can reject cheaply. Mid-run placement, bounded rework.
• The reviewer sees the decision, not the document. Diffs and deltas, not artifacts.
• The decision is recorded. Who, when, what they saw — in the audit trail, automatically.

The disclaimer version fails audits too

Regulators increasingly ask not whether a human was in the loop but what the human could see and do. A rubber stamp at the end of a pipeline answers neither well. A gate with recorded context answers both, and the evidence writes itself.

Design the loop. Don't disclaim it.