Formal intervention is not actual control

What it is

The UI has Approve, the flowchart has a human node, the compliance paper says a person is in the loop. Those are form. Actual control asks three things: can the person veto, does the veto in fact stop the consequence, and do they know they are holding that veto. Miss one, and the intervention is nominal. A nominal loop writes responsibility onto the person and leaves capability with the machine.

A button whose press only writes a log, while the mail still goes — that is an exhibit, not a gate.

Why it happens

Organisations need “someone signed” for audit. The shortest path to that need is a control that must be clicked, with the execution path unchanged. The control satisfies the audit’s check on existence, not control’s check on causality. People quickly learn: not clicking will auto-approve on timeout, or a veto will be questioned as blocking throughput, so the click becomes ritual.

Legal and ethical talk of human-in-the-loop often stops at “a person exists.” HCI has to translate that into causality: is the person a difference-maker. Difference-making means that without this person’s release, the act on the world boundary does not happen, and the person has a usable veto. A ritual node swaps difference-making for a witness.

Studying it

Draw the actual control flow, not the one in the product story: after a veto, did the world change; what does timeout default to; can the veto be bypassed. With people: veto once without warning and watch the system; then ask “was your approval required.” Independent variables: whether veto is wired to execution, timeout policy, whether vetoes are punished in evaluation. Dependent variables: effectiveness of veto, degree of ritual (approve-without-reading rate), attribution of responsibility.

Self-report of “I have control” and veto effectiveness often point opposite ways. The primary endpoint must be causal, not felt.

Where it stops holding

A system that only advises, and does not claim control, is consistent in form and fact; this entry does not apply. If the person has advice rights and the machine has the last word, and that is written down, the nominal problem becomes an honest-label problem. Rubber-stamping from too-high review frequency is one specific ritual mechanism, treated elsewhere; this entry is the more basic “the node is on the diagram, not in the causes.” A regulatory acceptance that only checks for a node will lock a nominal loop into production.

Applying it

• Wire approve to the execution switch: without a valid release, the act does not happen. Timeout must not silently release.
• Veto must be a first-class act, with consequence, with a record, not treated as a fault. Evaluation must not punish a reasonable veto.
• Split outward and inward copy: if the person cannot actually stop it, do not say they are in the loop; say they review after the fact.
• Check: in staging, have a reviewer veto and watch the world boundary. If the act still happens, the loop is fake. Then sample a batch of approvals and count how many were clicked in less than readable time — that batch is ritual, not control.

Related

• Same group: L1.05.1 The intervention point must sit before consequences land · L1.05.2 Intervention needs enough information and time
• Nearby: L1.09 Intervention points in the human loop · L4.15 Accountability and traceability · L4.07 Pre-action confirmation
• Search terms: nominal intervention · illusory human control · rubber-stamp review