What You Need to Know
A human gate is where a person checks or approves an AI action before it takes effect. Placement is where the gate sits. Pattern is the form oversight takes. Blast radius is how far a wrong action's harm spreads. Placement comes before pattern. The gate belongs where the consequence is high and the action is hard to reverse.
Take a self-storage firm whose agent tags overdue accounts, updates unit availability, issues refunds and schedules sales of defaulted units' contents. A wrong tag can be put right. A paid refund or a sold unit cannot.
Gate all of it and every tag waits for a person, so the system delivers nothing anyone will keep paying for. Gate nothing and irreversible harm is left to a probability. Reversibility and blast radius decide the placement, not seniority, squeamishness or a fixed percentage.
Anthropic's agent guidance agrees: an agent pauses for feedback at checkpoints or when it hits a blocker. That places the pause; it does not put one everywhere.
The Five Patterns
Approve-before-execute. The system proposes, a human authorises, then the action fires. For irreversible external effects: payments, deletions, outbound customer messages, production changes, anything with a legal or financial consequence. The firm's refunds and unit sales go here.
Review-before-release. The system drafts, a human signs off, and the output ships under that person's accountability. For consequential content: regulated advice, clinical documentation, statements that commit the organisation.
Triggered escalation. The system handles the routine and routes the uncertain, out-of-policy or high-value case to a person. The pattern rests on the trigger, since only the cases it catches reach anyone. An unvalidated confidence score only looks like a control, so validate it like any other classifier.
Post-hoc sampled audit. Nothing is gated; a sample checked afterwards keeps the quality claim honest. It fits work that is high-volume, reversible and low-severity per item, such as the firm's overdue-account tags. It also shows when reviewers stop reading, which stops the other patterns decaying.
Automate with a reversibility guarantee. No gate. An audit trail, an undo path or a compensating transaction makes the action cheap to undo. The firm's logged availability updates fit.
Some Gates Are Not Discretionary
Anthropic's Usage Policy settles some placements before any architecture work. It names eleven High-risk Areas, among them legal and medical advice and decisions on credit, insurance, housing and employment. A recommendation Claude makes in one of these areas is a High-risk AI Recommendation, and the policy requires two controls for it. A qualified person, with the authority to change the recommendation, must review it properly before it is delivered as advice or used to make a decision. The person it concerns must be clearly told that AI was used to produce it.
Both controls attach to a recommendation about one person: advice they might rely on, or a decision about them. The policy also lists exclusions: general educational information, wellness content on sleep, stress, nutrition or exercise, internal drafting, research, summarisation or analysis that is not the final recommendation delivered, and business operations that do not advise or decide about anyone in particular. So check what the output does, and to whom, before assuming policy has placed the human. A summary for the firm's managers decides nothing about any one tenant, so the policy does not reach it. A reply about one tenant's account is about a person. The next question is whether its subject falls in one of the areas.
Anthropic's commercial terms make judging whether outputs are appropriate, including where human review is appropriate, the customer's responsibility.
Making the Reviewer Effective Rather Than Decorative
The ICO's test: a decision does not fall outside the automated-decision rules just because a human has rubber-stamped it. Reviewers must check the recommendation rather than routinely apply it, with the authority and competence to go against the system.
Most gates fail one constraint. If reviewers see only the data the system saw, they weigh no additional factors, and the decision may be treated as solely automated. So the reviewer gets the trace, the sources, the flagged uncertainty, at least one input the model never had, and enough time to use them. Before a unit sale, the firm's manager also reads the tenant's last call notes.
A Gate Is a Control With a Performance Number
Three numbers matter: override rate, reviewer agreement and time per item. An override rate that rounds to zero at high daily volume is a rubber stamp. Either reviewers cannot see enough, or the gate sits in the wrong place. A manager passing hundreds of refunds a day unchanged is not checking them.
The ICO is explicit that automation bias is not fixed chiefly by training reviewers. Controls start at scoping and design: the business, data scientists and oversight function agree up front what the system considers and what the human weighs.
Accountability follows the signature. The person who approves owns the outcome, so they must see its basis. That is 5.5's explainability obligation from the reviewer's side.
In the exam
Items test selection between the five patterns. Automate with a reversibility guarantee is a legitimate keyed answer wherever the stem says the action is low-impact and reversible. In a High-risk Area, the item converts "should there be a human here" into "where in the flow does the qualified person sit, and what do they see". The second-best answers hide in reviewer design.
The Mixed Answer Is Usually the Professional One
When a stem pairs a throughput constraint with a reversibility distinction, the keyed answer splits the flow. One pattern applied uniformly fails half the requirement: gate everything and the backlog stays, gate nothing and the irreversible path is unguarded. Pick the option that gives each path its own pattern, as the firm splits availability updates from unit sales.
The list of High-risk Areas moves; read the current one rather than memorising it.
Exam Traps
Requiring human approval for every action the system proposes
It reads as the cautious choice and it fails the business requirement the stem has already stated. Volume then forces reviewers into routine approval, so the gate manufactures exactly the rubber-stamping the ICO warns about.
Placing the human check at a periodic retrospective review when the harm has already left the organisation
Post-hoc sampling is the right pattern for high-volume reversible work and the wrong one here. A sample keeps a quality claim honest; it does not recall a payment, a deletion or a message to a customer.
Quoting a fixed sampling rate with no severity, volume or reversibility argument behind it
The rate is arbitrary, so it cannot be defended when the miss happens. It also leaves the irreversible cases unreviewed at the same proportion as the harmless ones, which is the failure the rate was meant to prevent.
Escalating to a human whenever a model-reported confidence score falls below a threshold nobody validated
The entire pattern rests on the trigger. An unvalidated score is a classifier with unknown error rates deciding which cases a person ever sees, and its misses are invisible by construction.
Practice Scenario
A payroll assistant investigates pay queries and can issue corrections. Small corrections net off against the next monthly run and stay fully reversible until it closes; anything issued as an immediate off-cycle payment leaves the organisation and can only be recovered by asking the employee to return it. The team currently clears queries three weeks in arrears. The single payroll manager cannot check every correction, but no payment may leave the organisation unchecked. What is the right oversight design?
Build Exercise
Design and Stress-Test the Human-Oversight Layer
What you'll learn
- How to classify every action by reversibility and by the window in which reversal is still possible
- How to select between the five oversight patterns on evidence rather than on comfort
- How to recognise when a qualified reviewer is required rather than optional
- How to specify the evidence and the time budget a reviewer needs to be effective
- How to set the override rate at which you would conclude the gate is decorative
- List every action your system can take and mark each reversible or irreversible, with the window during which reversal is still possible
Why: The window is where teams get this wrong. Plenty of actions are reversible for an hour and permanent afterwards.
You should see: An action inventory with a reversal window per row, including the rows where the window is zero.
- Assign one of the five patterns to each action and justify it from reversibility and blast radius rather than from seniority or comfort
Why: Pattern selection is the skill the exam tests, and writing the justification exposes the assignments made out of nervousness.
You should see: One pattern per action with a one-line justification that mentions reversibility or blast radius by name.
- Check the regulatory shape: if the use case makes High-risk AI Recommendations, a qualified person must review each one before it is delivered or acted on, so place that person explicitly and write what they see
Why: In those areas the reviewer is not a design option, so an architecture that leaves them out is wrong before the trade-off is even weighed.
You should see: Either a named reviewer role positioned in the flow with their evidence pack, or a written finding that the use case falls outside those areas or within an exclusion.
- For every gate, specify the evidence the reviewer receives, including at least one input the model did not have, and the time budget per item
Why: The ICO test is that a reviewer restricted to the system data is arguably not weighing additional factors, which makes the decision effectively automated.
You should see: An evidence list per gate, with the additional input named, and a seconds-or-minutes budget that survives the daily volume.
- State the override rate you expect if the gate is real, name the rate at which you would call it a rubber stamp, and write what you would change first when that number arrives
Why: A gate with no expected number cannot be audited, and deciding the response in advance stops the finding being explained away later.
You should see: Two numbers and one pre-committed action, recorded where the team that runs the gate can see them.
Sources
- Usage Policy — Anthropic
- Commercial Terms of Service — Anthropic
- How do we ensure individual rights in our AI systems? — Information Commissioner's Office
- Building effective agents — Anthropic
- Claude Certified Architect Professional Exam Guide (v1.0) — Domain 5 — Anthropic