Human-in-the-Loop
An approval step that asks a person to authorize a high-risk action before the agent takes it. Intercis does not run one.
- Measured: 40 of 47 payloads, our own corpus
- Not measured: latency
- Observed, not governed: hosted MCP tool calls
What it is
Human-in-the-loop (HITL) is a control mechanism where ambiguous or high-severity agent actions are paused and escalated to human review before execution. The agent cannot continue until a human approves, denies, or modifies the action.
HITL sits between pure automation (agent makes all decisions) and pure manual (human makes all decisions). It preserves agent autonomy for routine tasks while enforcing human oversight for consequential decisions.
Why it matters
Agents are non-deterministic. An agent might attempt an action that isn't clearly allowed or clearly denied by policy rules. It might be attempting something legitimate in an unusual way, or it might be attempting something harmful. A human reviewer can make that judgment faster than encoding it into increasingly complex policy rules.
HITL also provides accountability. If an agent deletes important data, the audit trail shows whether the action was human-approved or auto-allowed. Regulators and auditors care about that distinction.
How it works
In a product that runs one, the system holding the tool call decides this action needs a person: it matched a rule marked for review, or policy says that class of action always gets one. The call is held instead of going on.
The reviewer gets the context: which agent, what it asked for, why it was held, and when. They approve, deny or edit the action, and the decision goes into the audit trail and back to the agent as a structured response. None of that runs here. The next section is what Intercis does instead.
What Intercis does instead
Today, Intercis's policy engine returns a verdict on each tool call on the LLM API wire (allow, deny, or observe) from a deterministic deny-list of regex patterns plus an LLM classifier. It does not run a live human-in-the-loop approval loop: pending exists as a verdict state for actions that would require human review, but no reviewer approve/deny action is wired up yet, and nothing auto-terminates a session on a policy match.
Because enforcement is deterministic rather than routed to human reviewers, OWASP T10 (Overwhelming Human-in-the-Loop) does not arise here: a matched deny policy blocks the call outright rather than queuing it for a person to approve.
Related terms
What Intercis does not govern
Intercis judges the tool calls that cross the Anthropic and OpenAI API wire. When a hosted MCP server runs a tool for the model, that call has already run by the time the response reaches the proxy, so it is observed, not governed: it writes one observe row and is never judged or blocked. Being in path is also a configuration setting: a process that can change its own base URL can route around the proxy unless network egress control forces the traffic through it.
The T-numbers on this page are from Agentic AI Threats and Mitigations v1.1, published by the OWASP GenAI Security Project and read in April 2026. OWASP revises that document, so check the current edition before you carry a number from here into your own threat model.