[EAAPL-HIL001] Human Approval Gateway

Category: Human-in-the-Loop
Sub-category: Oversight / Approval Control
Version: 1.3
Maturity: Mature
Tags: human-oversight, approval-workflow, high-stakes-AI, risk-scoring, audit-trail, EU-AI-Act-Art14
Regulatory Relevance: EU AI Act Articles 14 & 29, APRA CPS 230, ISO 42001 §8.5, NIST AI RMF MANAGE-1.3, GDPR Article 22

1. Executive Summary

High-stakes AI systems — those authorising transactions, making clinical recommendations, or influencing consequential administrative decisions — must not operate with full autonomy. The Human Approval Gateway pattern establishes a mandatory checkpoint between AI recommendation and consequential action, ensuring a qualified human reviews, approves, or rejects AI-proposed actions before they take effect.

This pattern is the foundational implementation of EU AI Act Article 14's human oversight requirement for high-risk AI systems. It defines the approval trigger logic, approval queue design, timeout handling (with configurable responses: escalate, cancel, or time-limited auto-approve with full audit), approval authority levels, and the immutable audit trail required by regulators.

Organisations that implement this pattern have passed EU AI Act conformity assessments, satisfied APRA supervisory expectations for AI in credit decisioning, and reduced AI-driven operational incidents by 40–70% by catching model errors before they produce irreversible consequences.

Target audience: Chief Risk Officers, Chief Compliance Officers, AI Governance leads, Enterprise Architects.

2. Problem Statement

Business Problem

AI systems in consequential domains can cause significant harm when they err without human review. A loan declined by a miscalibrated model, a clinical alert suppressed by a misconfigured AI, or a fraud block applied to a legitimate high-value customer — these outcomes damage customer relationships, create legal liability, and attract regulatory action.

Technical Problem

• Many AI systems are designed as straight-through processors: AI decision → action, with no human in the loop.
• Where manual review exists, it is often implemented as an afterthought — a separate queue tool with no integration to the AI decision context, poor UX, and no audit trail.
• Timeout handling is undefined: if no human responds within SLA, the system either blocks indefinitely or silently auto-approves.
• Approval authority levels are not enforced: any available agent may approve high-risk decisions regardless of qualifications.
• The audit trail captures only the final approval but not the AI recommendation, confidence score, or supporting rationale reviewed by the approver.

Symptoms

• AI errors causing irreversible customer harm that would have been caught by human review.
• Regulatory audit finds no evidence of human oversight for automated consequential decisions.
• Approval queue backlogs causing SLA breaches and frustrated customers.
• Post-incident investigation cannot reconstruct what the human reviewer saw at the time of approval.
• Different approvers applying inconsistent standards because approval guidelines are not embedded in the review interface.

Cost of Inaction

3. Context

When to Apply

• AI systems classified as high-risk under EU AI Act Annex III (credit, employment, law enforcement, clinical, essential services).
• AI actions that are consequential, difficult to reverse, or have significant financial/health/safety impact.
• AI systems where model confidence is insufficient for full automation (confidence below 90th percentile threshold).
• Regulatory or policy mandate for human-in-the-loop (APRA prudential requirement, clinical governance).
• AI systems operating in domains with active judicial review (immigration, benefits, credit).

When NOT to Apply

• Trivial, easily reversible AI actions (content formatting, auto-tagging, draft generation).
• AI systems with demonstrated near-perfect accuracy over a large sample (≥99.5% accuracy) for specific low-risk subtask categories, with formal risk-based exemption documented.
• Situations where human review latency would cause harm greater than the AI error rate (emergency medical AI where delay kills — use audit-based oversight instead).

Prerequisites

Industry Applicability

4. Architecture Overview

Design Philosophy

The Human Approval Gateway is designed on four principles: no autonomous action without approved authority, full context for the approver, defined timeout handling, and immutable comprehensive audit.

Approval Trigger Logic. Not every AI output requires human approval — that would be unworkable and provide no benefit for low-risk routine outputs. The gateway applies trigger logic based on three dimensions: (1) Risk score: AI assigns a risk score to each proposed action; actions above the configured risk threshold are routed to the approval queue. The threshold is calibrated to balance oversight burden (approver workload) against risk coverage. (2) Action type: Certain action types always require approval regardless of confidence (e.g., any adverse decision under GDPR Art. 22; any action with regulatory notification obligation). (3) Confidence threshold: If the AI model's calibrated confidence score falls below a configured threshold (e.g., <85% confidence), the action is routed for human review even if the risk score is moderate.

Context Package Design. The approver sees a structured Context Package — not a raw model output. The Context Package contains: the AI recommendation and confidence score; the key factors driving the recommendation (model explanation, e.g., SHAP values in plain language); the entity profile (customer, patient, applicant); relevant historical context; applicable policy and guidelines; the action to be taken if approved; and the consequences of approval vs. rejection. This design prevents approver over-reliance on the AI recommendation by ensuring the approver has sufficient context to form an independent judgment.

Approval Queue Management. The queue implements priority-based routing: high-risk and time-sensitive cases are prioritised; within priority bands, FIFO ordering ensures fairness. Approvers are matched to cases by authority level (junior agents handle standard cases; senior agents handle high-value or complex cases). The queue tracks SLA countdown per item; approaching SLA triggers escalation.

Timeout Handling. Three configurable timeout responses, selected by action type and risk level: (a) Escalate: When the primary approver SLA expires, the case escalates to a senior approver. This is the preferred response for high-risk cases. (b) Cancel: The proposed action is cancelled; the entity is notified that the request is under review. Used when the action is not time-critical and the consequences of auto-approval are severe. (c) Time-limited auto-approve with audit: For time-critical, lower-risk actions, the system auto-approves after SLA expiry with an explicit audit log entry noting the timeout auto-approval. This must be explicitly enabled; it is not the default.

Audit Trail. Every approval event generates an immutable audit record containing: action ID, AI recommendation, confidence score, context package snapshot (what the approver saw), approver identity and authority level, decision (approve/reject/modify), decision rationale (free text + structured reason code), decision timestamp, elapsed review time, and whether the decision aligned with or overrode the AI recommendation. Override decisions are flagged for pattern analysis (systematic overrides → model retraining signal).

5. Architecture Diagram

6. Components

7. Data Flow

Primary Flow

Error Flow

8. Security Considerations

Authentication & Authorisation

• Approvers authenticate via SSO/MFA; session tokens expire every 4 hours.
• Authority level enforcement: RBAC roles mapped to action types; enforced by Authority Enforcer component.
• Separation of duties: the AI system cannot approve its own recommendations; approvers cannot modify the AI context package.

Secrets Management

• Downstream system integration credentials managed in secrets manager; not exposed to approver UI.

Data Classification

• Context packages contain entity personal and financial data; classified as Confidential.
• Audit log contains sensitive decision data; classified as Confidential, retained per regulatory schedule.

Encryption

• Approval queue messages encrypted in transit (TLS 1.3) and at rest.
• Audit log encrypted at rest (AES-256); immutable storage (Object Lock).

Auditability

• Every action from submission to approval to execution is logged with actor, timestamp, and decision.
• Audit log tamper-evident (hash chaining or Object Lock).
• All timeout auto-approvals explicitly logged with reason code "TIMEOUT_AUTO_APPROVE".

OWASP LLM Top 10 Mapping

9. Governance Considerations

Responsible AI and EU AI Act Article 14 Compliance

EU AI Act Article 14 requires that high-risk AI systems are "designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which the AI system is in use." This pattern is the direct implementation of Article 14.

Specifically, Article 14 requires: (a) ability to understand AI capabilities and limitations — addressed by the context package confidence score and explanation; (b) ability to disregard, override, or intervene — addressed by the approve/reject/modify decision panel; (c) ability to interrupt operation via stop buttons — addressed by the cancel and defer actions; (d) assign oversight tasks to persons with competence and authority — addressed by the authority level enforcement.

Model Risk Management

• Systematic override rate (>20% of decisions in a category) triggers mandatory model review.
• Approval SLA breach rate (>5%) triggers capacity and workflow review.

Human Approval Checkpoints

• Gateway design (thresholds, authority matrix, timeout policy) approved by AI Risk Committee.
• Authority matrix reviewed quarterly; updated when action types change.
• Threshold adjustments require risk committee sign-off.

Governance Artefacts

10. Operational Considerations

Monitoring

SLOs

Logging

• All approval events logged in structured JSON; retained 10 years (EU AI Act Art. 12 minimum for high-risk AI).
• Logs include full context package snapshot; approver identity; decision; rationale; timing.

Incident Management

• Approval queue outage → P1; AI system operates in hold mode (no actions until queue restored).
• Override rate spike (>30% in 1 hour) → P2; AI Governance lead notified; model review triggered.

Disaster Recovery

11. Cost Considerations

Cost Drivers

Optimisations

• Reduce approver volume by tuning risk threshold (fewer items in queue); validate with risk committee.
• Automate low-complexity context package assembly to reduce approver cognitive load and review time.
• Batch similar cases for a single approver session to reduce context-switching overhead.
• Use confidence calibration to minimise mid-confidence routing; most items should be high-confidence-auto or clearly-routed-to-human.

Indicative Cost Range

12. Trade-Off Analysis

Option Comparison

Architectural Tensions

13. Failure Modes

14. Regulatory Considerations

15. Reference Implementations

AWS

Azure

GCP

On-Premises

16. Related Patterns

17. Maturity Assessment

Overall Maturity: Mature — Human approval workflows are a well-established operational pattern. EU AI Act Article 14 has accelerated standardisation. Production implementations exist across financial services, healthcare, and government sectors globally.

18. Revision History