Human in the Loop, On the Loop, In Command

The difference is whether the system can act without you. Human in the loop puts a person inside the execution path: the action is drafted, it waits, and nothing happens until someone approves it. The failure is caught before it occurs. Human on the loop puts the person outside that path but watching: the system executes on its own, and the human can intervene, veto, or roll back. The failure is caught during or after. That distinction sounds academic until you apply it to an irreversible action. On the loop is adequate for a write you can undo and catastrophic for an email you cannot unsend.

Human in command is authority over the system rather than over any particular action. It means a named person decided this system should be deployed, defined the boundaries it operates within, and retains the ability to shut it down. It is the broadest of the three and the easiest to claim without having. The test is whether you can name the owner, point at the written scope, and demonstrate a kill switch that has actually been exercised. Authority you cannot exercise in the moment you need it is not authority, and a control tested for the first time during an incident is a control you are discovering rather than using.

Yes, and most production systems are exactly that. Human in command says nothing about whether individual actions are reviewed. A system can be fully human in command while executing thousands of unreviewed writes a day, because the standing authority is intact even though nobody approved any single one of them. This is why organisations that can only demonstrate human in command still have an accountability gap on individual actions, and why regulators ask about both. Answering the oversight question with the broadest of the three models is the most common way to sound compliant while remaining exposed.

All three, applied to different things. Human in command over the system as a whole: a named owner, written scope, working kill switch. Human on the loop over the reversible majority of its work: enrichment, activity logging, filling empty fields, all running unattended but logged and revertible. Human in the loop over anything that reaches a customer or changes a system of record. The mistake is picking one model for everything. Gating every action means nobody reads the hundredth identical approval and the gate becomes decorative; gating nothing means the first bad run is also the first time you look.

Gate by consequence, not by category. Three questions settle almost every case. Can this be undone, and how easily? Does it reach a customer, where a wrong action costs trust rather than a database row? Does it change a system of record that other decisions are made from? Any yes puts the action in the loop. Everything else can run on the loop provided it is attributed to the agent's own identity, logged, and reversible. The point of spending human attention sparingly is that attention is the scarce resource: a review queue nobody can keep up with produces rubber-stamping, which is worse than no gate because it looks like oversight.

The EU AI Act addresses human oversight for high-risk systems in Article 14, requiring that such systems be designed so people can effectively oversee them, including the ability to intervene or interrupt. It describes oversight capability rather than mandating one of these three labels, which is why the distinction matters in practice: a vendor can satisfy the wording with monitoring alone. The NIST AI Risk Management Framework structures oversight as govern, map, measure and manage, where measure and manage are continuous and post-deployment. OWASP's LLM Top 10 lists Excessive Agency and recommends human-in-the-loop control specifically for high-impact actions, which is the narrowest and strongest of the three models applied exactly where it is worth its cost.

ASTRA is built so the approval gate is structural rather than a setting. Anything customer-facing or touching a system of record waits for a human yes; reversible internal writes run unattended and record a receipt that can be rolled back. Each agent acts under its own scoped identity rather than a borrowed login, so every action is attributable, and the audit trail records what was proposed, who decided, what changed, and how to reverse it. In the vocabulary above: human in command over the deployment, human in the loop on consequential writes, human on the loop everywhere else.