Muhammad Basim
Ai & Automation

Human-in-the-Loop: Where to Put the Approval Step

By Muhammad Basim·

Approve everything and you haven't automated anything — you've built yourself a queue and called it a system.

Approve nothing and you've built a machine that ships your mistakes faster than you can find them.

The interesting question isn't whether to have a human in the loop. It's where exactly the checkpoint goes, and the answer is more specific than "review the output."

The short version

Three tests. If any is true, a human checks before it goes out:

  1. Is it irreversible?
  2. Does it represent you publicly?
  3. Does being wrong cost money or trust?

And one that decides where rather than whether: put the checkpoint at the last cheap moment — the latest point where a correction is still trivial.

The three tests

Irreversibility. A sent email, a published post, a charged card, a posted comment. You can delete a tweet, but you can't unsee it — and you certainly can't unsend anything. Reversible actions can run unsupervised because the cost of being wrong is bounded.

Public representation. Anything carrying your name that reaches an audience. The asymmetry matters here: fifty good automated posts don't build as much as one bad one destroys, because the bad one is what gets screenshotted.

Cost of being wrong. Pricing, contractual language, factual claims about your service, anything touching a live customer relationship. Money and trust are the two things automation can't repair when it breaks them.

If none apply, run it unsupervised and sample occasionally. Most data-movement automation falls here, which is why it's the right place to start.

Where the checkpoint goes

The part most guides skip, and the part that determines whether your approval step survives contact with a busy week.

Put it at the last cheap moment.

Not the earliest — that's where you end up approving inputs and losing the time saving. Not after publication — that's not approval, that's cleanup.

A content workflow, worked through:

  1. AI drafts a post →
  2. Formatted and given a title →
  3. Images added →
  4. Scheduled →
  5. Published

Checkpoint at step 1 means you're reviewing raw drafts and doing all the formatting yourself. You've automated almost nothing.

Checkpoint at step 5 means it's already public.

Checkpoint at step 4 — reviewing the finished, scheduled, ready-to-go item before it publishes — is right. All the mechanical work is done, the thing is in its final form, and rejecting it costs one click.

The principle: let the automation do all the work it can, and put the human at the last gate before the irreversible action.

Approval that survives a busy week

Design matters more than intention here, because a checkpoint that's tedious gets rubber-stamped within a fortnight.

Make approval a single action. A Slack message with Approve and Reject buttons. An email with two links. Something you can action from your phone in ten seconds.

Show enough context to decide. If approving means opening three tabs to work out what you're looking at, you'll approve without checking. Include the finished output in the notification itself.

Default to not shipping. If nobody responds, it should sit in a queue rather than proceeding. An approval step that times out into publication is worse than no approval step, because it gives you false confidence.

Make rejection informative. A reject button that also lets you say why gives you a record of what's going wrong, which tells you whether to fix the prompt, the process, or abandon it.

Batch where sensible. Ten approvals in one sitting is more sustainable than ten interruptions across a day, and context-switching is the hidden cost that kills these systems.

Should AI content be reviewed before publishing?

Yes, and the reasons are more specific than general caution.

Factual accuracy. Models produce confident, plausible, wrong statements — and the confidence is the problem, because wrong output looks the same as right output at a glance.

Voice. AI output has a characteristic register. Left unreviewed across dozens of pieces, your site develops a sameness readers notice.

Context you didn't provide. The model doesn't know about the client situation, the thing you said last month, or the campaign running next week.

Accountability. If something wrong goes out under your name, "the AI wrote it" isn't a position you want to occupy publicly.

But review properly rather than nominally. Reading through and thinking "seems fine" isn't review. Check the specific things that go wrong: named facts and figures, claims about how something works, anything attributed to a source, and whether it sounds like you. The full process.

Sampling versus checking everything

Once volume grows, checking everything stops being realistic — and pretending otherwise produces worse quality than admitting it.

The alternative: sample properly.

Review a random ten percent thoroughly rather than every item superficially. A genuine check on one in ten catches systematic problems better than a glance at all ten, because systematic problems appear in the sample too.

When sampling is appropriate: high volume, low individual stakes, and a process that's been stable and reviewed thoroughly for a while.

When it isn't: anything hitting the three tests above. You don't sample the emails going to customers.

Increase sampling after any change — a new prompt, a new model version, a new data source. Changes are where new failure modes appear, and your existing sample rate was calibrated for the old system.

What should never be fully automated

Direct, since it comes up constantly.

Anything that spends money. Ad budgets, purchases, payouts.

Anything contractual or legal. Terms, pricing commitments, formal correspondence.

Anything responding to a complaint or a crisis. The moments people most remember are exactly the moments automation reads as contempt.

Anything where the relationship is the product. If people work with you because you're personally attentive, automating attentiveness removes the thing they were buying.

Anything you can't specify. If you can't articulate what a good outcome looks like, you can't build something to produce it and you can't evaluate what comes out.

One that's less obvious: anything you'd be embarrassed to explain. "This was automated" should be something you'd say comfortably. If you'd rather the recipient didn't know, that's a signal.

When to remove the checkpoint

Approval isn't permanent. It should decrease as evidence accumulates.

Track your rejection rate. If you've approved 200 consecutive items without a single rejection, the checkpoint is theatre and you're paying attention costs for nothing.

The graduation path: approve everything → sample heavily → sample lightly → spot-check occasionally.

Move down a level only after a sustained clean run, and move back up immediately after any change to the system. That's a rule worth writing down, because the instinct after a change is to trust the thing that's been working — and the change is precisely what invalidated the evidence.

Frequently asked questions

Should AI content be reviewed before publishing?
Yes. Models produce confident, plausible, wrong statements, and confident wrong output looks identical to correct output at a glance. Beyond accuracy, AI has a characteristic register that produces noticeable sameness across a site, and it lacks context you haven't explicitly provided. Review properly rather than nominally — check named facts, figures, claims about how things work, and whether it sounds like you, rather than reading through and concluding it seems fine.

How do I add approval to a workflow?
Insert a step that pauses execution and notifies a person, with the finished output included in the notification itself. Most platforms support this — Slack messages with buttons, approval emails with links, or a built-in approval action. Three design rules matter more than the mechanism: make approving or rejecting a single action, show enough context to decide without opening other tabs, and default to not shipping if nobody responds.

What should never be fully automated?
Anything that spends money, anything contractual or legal, anything responding to a complaint or crisis, and anything where a personal relationship is what you're actually selling. Also anything you can't specify — if you can't articulate what a good outcome looks like, you can't build a system to produce one or evaluate what it produces. A useful additional test is whether you'd say "this was automated" comfortably; if you'd rather the recipient didn't know, that's the signal.

What to do next

Take your riskiest automation — the one that sends, publishes, or spends — and check where the human checkpoint sits.

If there isn't one, add it at the last cheap moment: the point where everything is finished and ready, and rejecting costs a single click.

If there is one but you approve everything without reading, that's worth knowing too. Either the checkpoint is badly designed, or your rejection rate says you've earned the right to sample instead.

Free: The automation planning checklist.


Related guides

Join the Newsletter

Get practical marketing tactics delivered straight to your inbox.

Muhammad Basim

Written by

Muhammad Basim

Related Articles

Newsletter

Free: The 60-Minute
Email Authentication Fix

A no-fluff checklist from the Deliverability Playbook. In one hour: set up SPF, DKIM & DMARC correctly, check your domain against blocklists, and pass Gmail & Yahoo's 2026 sender requirements.

No spam — that would be ironic. Unsubscribe anytime.