Human-in-the-Loop AI Approvals: What Stays Yours

Ask the AP lead at a 40-person distributor how many approvals she clicks in a day and she will guess twenty. It is often closer to sixty: invoices over a threshold, a vendor setup, a credit memo, a change to a customer's terms. By mid-morning she is not reading them anymore. She is clearing them. And the one request that mattered that week, a long-time supplier "updating" its bank details by email, went through the same click as the rest.

That is the problem human-in-the-loop AI approvals are supposed to solve, and it is also how they usually fail. Putting a person in the loop is easy. Putting a person in the loop where their attention actually changes the outcome is the design work. This post covers how to decide which actions an agent can take alone, which need a sign-off, what a good approval request looks like, and how autonomy should grow over time.

Two ways the loop breaks

Everything needs approval. It feels safe. In practice the person in the loop becomes a rubber stamp, because nobody can read sixty requests a day with the same care. Control on paper, none in fact. It is also the carburetor version of AI: the system does the work, then waits for you to remember to come and look. You have moved the chore, not removed it.

Nothing needs approval. The opposite promise, sold as speed. The agent posts, pays and emails customers on its own from week one. When it is wrong, nobody hears about it until a customer or a bank statement says so. A system that makes mistakes without telling anyone is worse than no system at all.

The fix for both is the same: decide where a person adds judgment, put them there, and take them out of everywhere else.

Sort actions by what a mistake costs

Don't sort by how hard a task is for the AI. Sort by what happens if it gets one wrong. Three tiers cover most of a back office:

• Cheap and reversible: the agent acts and logs it. Coding an invoice to the usual GL account, matching a payment to the invoice it obviously belongs to, filing a document, drafting a reminder. If it is wrong, someone fixes it in a minute and nothing left the building.
• Reversible but visible: the agent acts, a person reviews a sample. A collections email to a customer, a held invoice, a price correction on a draft quote. Mistakes are fixable but someone outside may see them, so the review is regular, not optional.
• Irreversible, money out, or legal weight: a person decides, every time. Releasing a payment, changing a vendor's bank details, writing off a balance, signing or changing a contract, anything that touches a tax filing. The agent prepares the decision. It doesn't make it.

The third tier is not theoretical caution. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion (2025 IC3 Annual Report). Those schemes work by getting someone to send money somewhere it should not go. A change to where money goes is exactly the kind of action that should never run without a person who confirms it through a channel the request did not come from, such as a call to a phone number you already had on file.

Where the agent earns its keep in that tier is noticing. It can see that the "new bank details" email came from a domain one letter off from the supplier's real one, or that the request arrived two days before a large invoice was due, and put that in front of the approver instead of burying it.

Make every approval worth a person's attention

Once only the decisions that need a human reach one, each request should be quick to decide well. A good approval request carries:

• What the agent wants to do, in one line: release $18,400 to this vendor on Thursday.
• Why, with the evidence attached: the PO, the receiving record and the invoice match within tolerance.
• What is unusual, if anything, stated first and plainly: the remit-to address changed since the last payment.
• What happens if nobody answers. The safe default is that nothing happens and the request escalates. Silence should never mean yes.

Put the request where the approver already works, whether that is email, the accounting system's approval queue or the task list the team opens anyway. A new screen to check is one more thing to remember. This is the same principle behind exception-based management with AI: the routine runs, and only the exception reaches you.

Autonomy goes up with evidence, not trust

The tiers are a starting point, not a permanent setting. Each kind of action moves through three stages, separately:

• Suggests. The agent proposes, a person does it. Every disagreement is recorded. These first weeks are the calibration, not a courtesy: each correction shows where your business differs from the rules on paper.
• Executes with review. The agent does it, a person checks before or shortly after. You track how often the check changes anything.
• Executes alone. Only for a category with a long, clean record, and with a sample still audited on a schedule so a quiet month means nothing went wrong, not that nothing was caught.

Write down the promotion rule before you start, in your own terms: how many decisions, how few corrections, reviewed by whom. And write down the demotion rule too. A vendor changes its invoice format, a new product line launches, a rule changes: the agent drops back a stage until it has a clean record again. Raising autonomy is a decision you make on evidence, never one the system makes for itself.

Process first: you can't automate an approval nobody defined

Many SMBs have an approval policy and an approval reality, and the two often do not match. The policy says the controller signs off on anything over $5,000; the reality is that the owner approves by text when the controller is out, and nobody approves recurring vendors at all. Point an agent at that and it will follow whichever version it was shown, faster. Automating a broken process breaks it faster.

So the first deliverable is not software. It is a one-page approval matrix: each type of action, who approves it, the threshold, and the backup when that person is away. We explain why this order matters in why AI projects fail in small business, and the payables version of it in our guide to accounts payable automation.

If an action has tax or legal consequences, confirm with your accountant or attorney who should hold that approval. The agent can prepare the paperwork; the responsibility stays with the people who sign.

Where to start

For one week, have whoever approves things in your back office keep a simple list: every approval, what it was, how long it took, and whether they actually looked or just clicked. Then mark each line with the tier it belongs in. You will likely find that a large share of your approvals are cheap and reversible, and that the handful that really matter are getting the same two seconds as the rest.

That list is your design. The agent takes the first tier off the desk, the second gets sampled, and the third finally gets real attention. An engine computer manages the mixture. It doesn't choose the destination. If you want a rough figure for what those hours cost today, the RubikSoft ROI calculator is a practical place to start.