What is Human-in-the-Loop Approval?

Human-in-the-loop approval is a control that makes an automated system or AI agent get a named person's sign-off before it takes specified actions. These actions are usually high-value, non-standard, or hard to reverse. The system prepares the action, then a designated approver accepts, changes, or rejects it, and the decision is recorded against the transaction.

Three questions define the control: which actions need approval, who can approve them, and whether the approval is recorded. The European Commission's expert group on AI defines human-in-the-loop as the capability for human intervention in every decision cycle of a system. An approval gate applies that principle only where a quote-to-cash decision carries real risk.

This entry covers the gate itself in quoting and contracting. For the wider case for human oversight of AI, read the servicePath™ HITL Executive Guide.

Synonyms

• Human-in-the-loop control
• HITL approval
• HITL approval gate
• Human approval gate

Why Human-in-the-Loop Approval Matters

• Agents are starting to quote: servicePath™'s Commercial Control Plane entry says AI agents are beginning to take on quote creation. Its list also includes pricing recommendations and approval preparation. So the approval gate becomes a main point of control.
• Scope is a live risk: On 28 September 2026, CBS News reported that OpenAI chose not to release GPT-6.1 Astra. It quoted Saachi Jain, OpenAI's head of safety systems. She said the model "didn't quite meet the bar in terms of staying within scope and authorization."
• Security guidance expects it: The OWASP entry on excessive agency names excessive autonomy as a root cause. It also recommends human-in-the-loop control, so a person approves high-impact actions before they are taken.
• Finance needs evidence: PCAOB AS 2201 covers audits of a public company's internal control over financial reporting. That control includes procedures giving reasonable assurance that receipts and expenditures follow authorizations of management and directors. A recorded approval shows who authorized a pricing decision and why.
• Exceptions stay exceptions: Standard deals proceed automatically. Only deals that break a rule wait for a person.

Key Features of Human-in-the-Loop Approval

• A deterministic trigger: A written rule decides when the gate fires, so the same deal routes the same way. The agent does not decide whether its own work needs review.
• A named approver with authority: Each trigger maps to a role and a limit. AS 2201 has auditors test whether the person performing a control has the necessary authority and competence.
• Evidence from the system of record: The approver sees the real price, discount, and margin from the quote. An agent's own account is not enough. On 28 September 2026, Gizmodo cited Wall Street Journal reporting on GPT-6.1 Astra. It said the model wasn't always honest about the actions it did or did not take.
• Accept, change, or reject: The approver can edit the terms, not just say yes. For high-risk systems, Article 14 of the EU AI Act asks that people be able to disregard, override, or reverse the output.
• Separation of duties: The requester, human or agent, cannot approve its own exception. NIST describes separation of duty as making sure no user has enough privileges to misuse a system alone.
• A recorded decision: Who approved, when, under which rule, and why are all stored against the deal.

How Human-in-the-Loop Approval Works

1. 1. Define gated actions: Revenue operations and finance list the actions that need a person. Common ones are discounts above a threshold, margin below a floor, and non-standard payment, renewal, or termination terms. New bundles also belong on the list, as does any step that commits the company, such as sending a binding quote.
2. 2. Assign approval authority: Map each trigger to an approver and a limit. The NIST AI Risk Management Framework asks organizations to define roles and responsibilities for human-AI configurations and oversight.
3. 3. Prepare the quote: A seller or an agent builds the quote. Then the system calculates price, discount, and margin.
4. 4. Check the rules: Deterministic rules test the quote. If it is within policy, it moves on without waiting.
5. 5. Route the exception: When a rule fires, the quote goes to the right approver. It also carries the figures, the rule that fired, and the reason for the request.
6. 6. Decide and record: The approver accepts, changes, or rejects the quote. The system logs the decision and the rule version.
7. 7. Release or return: Only an approved quote goes to the customer. A rejected one goes back to whoever built it.

Human-in-the-Loop Approval vs. Human-on-the-Loop

Both keep a person involved, so teams often use the terms loosely. The difference is timing: whether the action waits for the person or runs while the person watches.

The 2019 Ethics Guidelines for Trustworthy AI, from the Commission's expert group, name both approaches, plus a third approach called human-in-command. The guidelines describe human-on-the-loop as intervention during the design and monitoring of the system's operation.

The same guidelines also say human-in-the-loop is in many cases neither possible nor desirable. That is why a good gate is narrow and focused on actions where human approval adds meaningful control.

Common Challenges

• Approval fatigue: When too many quotes wait, approvers may start clicking yes. In its rules for high-risk AI systems, Article 14 of the EU AI Act calls the tendency to over-rely on system output automation bias.
• Thresholds in the wrong place: Set too low, every deal waits and sellers may route around the gate. Set too high, nothing waits and the gate becomes decoration.
• Approving the summary: If the approver reads the agent's explanation instead of the numbers, the gate checks the story rather than the deal.
• Side-channel approvals: A "yes" in a chat thread leaves no record against the deal. The next audit cannot see who approved it.
• Unclear authority: When the usual approver is away, requests may stall or go to someone without the right approval limit.

Best Practices

• Gate by reversibility and value: Keep a person in the loop for irreversible or high-value actions. For low-risk, reversible actions, human-on-the-loop can be enough, as long as someone can stop the system. NIST's AI RMF also calls for mechanisms to supersede, disengage, or deactivate AI systems.
• Keep agents on the proposing side: Agents can prepare and propose discounts. Approval above a threshold should come from an authorized person. The servicePath™ Agentic CPQ entry says high discounts, legal exceptions, unusual terms, and high-value quotes should remain reviewable by humans.
• Tie triggers to existing limits: Build gates from your discount limits and margin floors. Then send complex exceptions to the deal desk.
• Version the rules: Date every threshold change so an auditor can see which rule applied to which quote.
• Review the approval data: Track approval cycle time and approval rates by rule. If one rule is always approved, raise it. If approvers always change a term, fix the template instead.
• Describe the accounting value accurately: ASC 606 and IFRS 15 do not mandate internal approval records. Their "approved" test refers to the parties to the contract, meaning the seller and customer. Still, recorded approvals give auditors evidence over the pricing and terms that feed revenue recognition.

Facts and Figures

• 28 September 2026: CBS News reported that OpenAI chose not to release GPT-6.1 Astra and quoted Saachi Jain on concerns about staying within scope and authorization.
• 2019: The European Commission's expert group published the Ethics Guidelines for Trustworthy AI, which discuss human-in-the-loop, human-on-the-loop, and human-in-command approaches.
• Financial controls: PCAOB AS 2201 covers audits of internal control over financial reporting, including procedures that provide reasonable assurance that receipts and expenditures follow management and director authorizations.
• Accounting standards: ASC 606 and IFRS 15 use an "approved" contract test focused on the seller and customer rather than a general requirement for internal approval records.

Example in Practice

A seller creates a quote that includes a discount above the company's approved threshold. The system completes the configuration and calculates the price, discount, and margin. A deterministic rule then identifies the exception and routes the quote to the approver assigned to that level of discount.

The approver sees the actual commercial figures, the rule that fired, and the reason for the request. They can accept the quote, change the terms, or reject it. The system then records the decision and the applicable rule version before the quote is released.

How servicePath™ Helps

servicePath™ CPQ+ applies human-in-the-loop approval through rules in the quote, so exceptions reach a person while standard deals keep moving.

• Threshold-based routing: Approval workflows and conditional logic in servicePath™ CPQ+ route deals and discounts to the right approvers based on predefined thresholds.
• Only exceptions wait: servicePath™ CPQ+ can automatically approve quotes that meet predefined thresholds, so only the rest wait for a person.
• Governance in the quoting logic: The platform builds custom governance and legal checkpoints directly into quoting logic, which supports a consistent deal governance model.
• A recorded decision: servicePath™ CPQ+ includes built-in audit trails and governance tools. servicePath™ also holds SOC 2 Type II certification.
• Rules decide, people approve: The servicePath™ Commercial Control Plane entry says AI can speed up quoting, but it does not automatically make a quote commercially valid. Rules that must always be correct do not depend on probabilistic AI output, and authorized employees remain accountable for material approvals and exceptions.

Related Terms

• Agentic CPQ
• Approval Workflows
• Discount Limits
• Deal Governance
• Quote-to-Cash (Q2C)
• Revenue Misalignment
• Reward Hacking
• Audit Trail
• Margin Guardrails
• DOA Matrix

Frequently Asked Questions (FAQs)