Human-in-the-loop AI agents: how to design the gate so agents are safe in regulated work
Which actions an agent may take alone, which need a named approver, and how the ledger, verifier and escalation paths fit together. The model we use in healthcare and lending.
An AI agent that can send an email, move money or change a record needs a boundary. The boundary is not 'a human checks everything' — that recreates the manual process with extra steps — and it is not 'the model decides' either. It is a designed gate: a short list of actions the agent may take alone, a list that needs a named approver, and the machinery that makes both auditable. This is the model we use in healthcare, lending and collections.
Classify every action
Read, summarise, draft, propose, execute-reversible, execute-irreversible. Reading and drafting are almost always free. Execute-irreversible — sending to a customer, posting a payment, submitting a claim — needs a gate by default.
Plan → confirm → execute → verify
The agent states what it intends to do and why; the gate (a rule or a person) confirms; the action runs; an independent verifier checks the result against the intent. The verifier is a separate model call with a different prompt, so the agent does not grade its own homework.
Rules before people
Most confirmations can be rules: amount thresholds, counterparties on an allow-list, tone checks, time windows, contact-pressure limits. People are for the residue — new counterparties, exceptions, anything that fails a rule.
The named approver
Every gated action has one owner, notified with the plan, the evidence and a one-tap approve/reject. 'Anyone on the team' means nobody; the ledger records who approved.
The ledger
Append-only: intent, inputs, decision, approver, result, verifier verdict. This is what lets you answer 'why did the agent do that' six months later, and what a regulator or a client's auditor will ask for.
Escalation and stop
When a verifier fails, a rule trips or the agent is uncertain, the action pauses and escalates. Anything that stops the agent — a dangerous risk score, a compliance failure — can only be lifted by a person, after the underlying signal has changed.
Guardrails that cannot be raised
Caps and holds enforced in the dispatcher, not in the prompt. The user's daily limit is min(cap, guardrail cap); raising the cap cannot bypass a hold. This is how Quotarider's sequence guardrail works, and how we build every agent.
The same design underpins AI Governance & Security. If you are putting agents into a regulated workflow, send the workflow to enquiry@xdqlabs.com and we will map the gate with your compliance owner first.
10 fintech companies in India every B2B founder should study in 2026
What Razorpay, Zerodha, PhonePe and seven others get right about speed, trust and distribution — and the agent opportunities each pattern opens for the companies selling to them.
10 AI agent use cases for maritime and shipping companies
From laytime and demurrage to crew certificates: where document-heavy shipping operations lose money, and what an agent with a human gate can do about each one.
Why Indian hospitals lose revenue before the claim is even filed
The five rejection patterns we see most in claim data, and the pre-submission checks that stop them.
Want this built for your company?
A short brief to enquiry@xdqlabs.com gets a scope and a fixed price within two working days — or a straight answer that it isn't a fit.