The intervention point must sit before consequences land

What it is

Human-in-the-loop is not “a person sits beside the system.” It is a gate on the causal chain: without a person’s release, the consequence does not land. If the gate is fitted after the mail has gone, the money has moved, the content is public, the person is a witness. Intervention before consequence pins the loop before irreversible effects occur.

A notice afterwards, an undo afterwards, are not this gate. They are repairs.

Why it happens

Automation folds sense–decide–act into one continuous process. What a person has to interrupt is the beat where execution crosses a world boundary: send outward, write to production, delete, publish. Before that beat, state is still inside the system and change is cheap; after it, state lives in someone else’s inbox, a bank, a search index, and change becomes negotiation.

Products often hear “loop” as a reviewer seat on a dashboard. If the seat only refreshes after execution, the reviewer is looking at finished history. Automation-level models separate decision from action; what a person must keep is a veto before the action level, not a comment after the decision level.

Studying it

Shell the same agent task two ways: confirm before execute versus a summary after. Consequences should be real outbound (a test inbox, a test ledger). Dependent variables: share of harmful acts stopped, time from detection to stop, whether people believe they are still in the loop. Independent variables: whether the consequence is reversible, whether the notice interrupts.

“Believe they are in the loop” is the subjective measure that matters. Many people see a live log and report control, until asked “what do you press right now to make it stop.”

Where it stops holding

Cheap reversible acts (edit a local draft, generate a preview) do not need this gate; it would be friction. Acts that are technically deletable but socially irreversible (a list send, a public post) still count as consequence already landed. Control loops that must be extremely fast (some industrial stops) need an earlier, faster point — different constraints, same direction: before the effect lands. This entry does not discuss what information the person holds at the point, nor whether a formal button equals control.

Applying it

• List every act that crosses a world boundary: send, pay, delete, change permission, publish. Put a gate before each crossing, default stopped, release explicit.
• The other side of the gate must be “does not happen,” not “happened, try to take it back.” Take-back can exist; it cannot stand in for the gate.
• A log and an in-progress view cannot impersonate a gate. Without one release that must be pressed, the person is not in the loop.
• Check: in a test environment let the agent walk a full harmful path and see whether a human release sits on the world boundary. If none, take loop language off the product. Then ask the person on shift “how do you stop it going out right now” — if they cannot answer, the point is not before consequence.

Related

• Same group: L1.05.2 Intervention needs enough information and time · L1.05.3 Formal intervention is not actual control
• Nearby: L1.09 Intervention points in the human loop · L4.04 Takeover and handoff design · L4.07 Pre-action confirmation
• Search terms: intervention before consequence · human in the loop · pre-execution gate