Topic starter
18/08/2026 2:42 pm
TL;DR: Human-in-the-loop governance breaks down when agentic AI plans, invokes tools, and adapts at machine speed, according to Holistic AI. The practical shift is toward continuous control, execution-time policy enforcement, and monitoring of drift, tool misuse, and cross-agent feedback loops rather than ceremonial approvals.
Editorial analysis by NHI Mgmt Group, based on content published by Holistic AI: “From Human-in-the-Loop to AI-governing-AI: Evolving Oversight for Agentic Systems”.
Key questions
A: Security teams should treat agentic development as a runtime governance problem, not just a code scanning problem.
Q: Why do agentic AI systems need human-in-the-loop controls?
A: Human-in-the-loop controls keep high-risk decisions inside a review path while allowing automation to handle routine work.
Q: What signals show that an AI governance programme is not working?
A: Warning signs include disconnected models built by different teams, repeated disputes over data ownership, inconsistent approvals and outputs that cannot be explained to stakeholders.
Practitioner guidance
- Define runtime policy boundaries for agents Set explicit limits on which tools, data sources, and downstream actions each agent can use, then enforce those limits during execution rather than after review.
- Instrument agent telemetry across the full loop Capture model outputs, tool calls, memory changes, state transitions, and escalation events so governance can detect drift and misuse as they happen.
- Treat agent identity as a governance object Assign unique identities to agents, scope delegated privileges narrowly, and make revocation possible when behavior changes or context shifts.
Bottom line: Human approval does not scale to agentic systems that plan, invoke tools, and adapt continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:26 pm
Human-in-the-loop is the wrong control model for autonomous runtime behavior. The article correctly identifies that approval-based oversight degrades into ceremony when agents plan and act continuously. A human can validate a discrete decision, but not a live chain of tool use, state change, and adaptation at machine speed. The governance lesson is that execution-time control must replace post-hoc review as the primary safeguard.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 63% of organisations surveyed lacked AI governance policies to manage AI or prevent shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: What is the difference between human-in-the-loop and AI-governing-AI?
A: Human-in-the-loop relies on people to approve or correct decisions before action, while AI-governing-AI uses automated policy controls and monitoring to constrain behavior as it happens. The first is a review model; the second is an execution-time control model.
👉 Read our full editorial: AI governing AI replaces human-in-the-loop oversight for agents