Steering & Approving AI Agents: Human-in-the-Loop

In short: AI agents stay controllable when four things are defined: approval levels (what the agent may do alone and what only after approval), escalation rules (when it hands over to a person), spot checks (who checks how often) and a complete log. In the company cockpit your team sees all of this in one place – and decides instead of cleaning up.

The biggest barrier to AI agents in SMEs isn't technology, it's trust. In a YouGov survey of 438 decision-makers for bevh and Alibaba.com (September 2026), 32% named lack of trust in the technology as a barrier – more than any other reason. That is justified: an agent that answers e-mails or sends quotes on its own needs clear limits. This article shows how to set them.

Human-in-the-loop vs. human-on-the-loop

Model	How it works	Suitable for
Human-in-the-loop	The agent prepares, a person approves every single action.	Quotes, invoices, orders – anything with financial or legal effect
Human-on-the-loop	The agent acts itself; a person monitors, spot-checks and intervenes when something looks off.	Answering calls, booking appointments, status updates, sorting the inbox
Human-out-of-the-loop	The agent acts without human control.	Not recommended for customer-facing tasks in SMEs

In practice this matches the levels in the org chart with AI agents: "AI + human" is human-in-the-loop, "fully AI" is human-on-the-loop.

Flow: AI agent prepares, a person approves, escalation to the responsible person, log and spot checks — Approval, escalation, spot check, log – the four building blocks of control.

The four building blocks of control

1. Define approval levels

Every agent task gets one of three levels: may act (e.g. book an appointment), may prepare (e.g. quote draft – sent only after approval), may not (e.g. promise prices, grant discounts). These levels are written down in the agent's "job description".

2. Define escalation rules

A good agent knows when it's not responsible. Typical triggers for handing over: a complaint or angry tone, an amount above a threshold, an unknown situation, an explicit request for a human, uncertainty about the answer. What matters is to whom – in the cockpit the case lands directly with the responsible role.

3. Plan spot checks

Even with "fully AI", a person checks regularly. Densely at first (e.g. a handful of cases daily), less often once quality is stable. Errors found flow back to the agent as a rule or example.

4. Log everything

Every agent action is stored: what came in, what it did, what it relied on, who approved. The log is the basis for spot checks, error analysis and evidence for customers, auditors or authorities.

Least-privilege access

An agent gets only the access its task needs. The phone agent reads the calendar but not accounting. The receipts agent writes drafts into the accounting system but doesn't post them. That limits the damage of any error – and keeps the data protection impact assessment manageable. More: Sovereign AI for SMEs.

KPIs that belong in the cockpit

KPI	What it shows
Cases completed per agent	How much work the agent actually takes over
Approval rate without changes	How good the drafts are – if it rises, control can be loosened
Escalation rate	How often the agent hands over – too high means rules or knowledge are missing
Open approvals	Where your team becomes the bottleneck
Handling time	How fast customers get an answer
Errors from spot checks	Where to sharpen

How to derive the business value: Calculating AI ROI.

What the EU AI Act requires

Transparency (Art. 50): since 2 August 2026, people must be informed that they are interacting with an AI – e.g. when an agent answers calls or chats – unless this is obvious.
High-risk applications: AI in areas such as recruitment or credit decisions faces strict duties, including effective human oversight. Under the Digital Omnibus, the full requirements for these cases (Annex III) apply from 2 December 2027.
Automated decisions (GDPR Art. 22): decisions with legal or similarly significant effects on a person should not be left to an agent alone.

Most SME agents – phone, inbox, quotes, receipts – are not high-risk systems. A clean approval logic is still the best preparation. Details: EU AI Act 2026 and AI governance for SMEs. This section is not legal advice.

How your team steers in the company cockpit

In the company cockpit with AI agents the four building blocks come together. Each role sees its open approvals, escalated cases and agent results in the team portal. Management sees the KPIs across all positions. And because mysoftwarelab runs the cockpit as an external AI department, monitoring, maintenance and improvement of the agents are not your team's job – your team only decides.

FAQ: steering AI agents

How do I stay in control of AI agents?

With approval levels per task, clear escalation rules, regular spot checks and a complete log of all agent actions.

What does human-in-the-loop mean?

The agent prepares a task; a person reviews and approves every single action before it takes effect.

May an AI agent communicate with customers on its own?

Yes, for suitable tasks such as booking appointments or status updates. Since 2 August 2026, customers must be able to recognise that they are dealing with an AI (Art. 50 EU AI Act).

How much of my team's time does control take?

More at first, because spot checks are dense. As the approval rate without changes rises, control is loosened step by step – the cockpit KPIs show when.

Conclusion: trust comes from visibility

AI agents aren't trustworthy because the model is good, but because every step is visible and every critical action is approved. Set this up from the start and you can let agents work with a clear conscience.

Company cockpit with AI agents

The agents work, your team decides.

Callback within 24 hours – then see in a clickable prototype what approvals would look like in your cockpit.

Request a callback → Packages & pricing