Human oversight: designing decision points

Oversight is deciding in advance which decisions a system may take alone and which need a person. Four decision types and how to place them.

3 minread 654words last updated

The short answer

Human oversight of an AI system is not a person watching a dashboard. It is a set of decisions made in advance: for each decision the system touches, whether it may act alone, act alone with a sample checked afterwards, propose for a person to approve, or leave to a person entirely. Two factors place each decision: how reversible it is, and who it affects. Irreversible decisions about people are human only. Reversible, internal, routine decisions can be automatic with logging and sampling. The person at each decision point needs the proposal, the evidence and the power to change it; otherwise they are a rubber stamp. And oversight decays, so the placements are reviewed quarterly and the pause button is tested.

The four decision types

TypeThe systemThe personFits when
AutomaticActs and logsSees the log; nothing elseReversible, internal, routine, well-tested
Automatic with samplingActs and logsReviews a random sample monthlyReversible, moderate volume, quality proven
Proposed for approvalPrepares a proposal with evidenceApproves, edits or rejects each oneCustomer-facing, commitments, money, unusual cases
Human onlyPrepares, summarises, recommendsDecides, with authority to decide differentlyIrreversible, significant effect on a person, legally protected decisions

Placing the decisions

  1. List every decision the system touches, from “which folder to file this in” to “whether to approve this application”.
  2. Score each on reversibility: can it be undone cheaply, at some cost, or not at all?
  3. Score each on who is affected: nobody, the business internally, a customer, a person’s rights or livelihood.
  4. Assign a type from the table; when in doubt, one level more human.
  5. Design the review screen for proposed and human-only decisions: proposal, reasons, evidence, alternatives, one action to approve or change.
  6. Write the placements down in the governance documentation; they are policy.

Keeping oversight real

Rotate reviewers so nobody becomes numb to the queue. Sample approvals and check whether the reviewer would have caught a planted error. Watch the change rate in the log: a healthy proposed-for-approval flow has a visible share of edits and rejections. Test the pause button quarterly by actually pausing. Revisit placements when the system changes, when volume changes and when an incident shows a decision was placed wrongly.

What this means for you

Design oversight instead of assuming it. Classify every decision by reversibility and who it affects, assign one of four types, build review screens that make meaningful involvement possible, and write the placements into your governance. Then keep it alive: rotate, sample, watch the change rate, test the pause. Oversight placed this way protects people without slowing the routine, which is the only kind that survives. This is general information rather than legal advice.

Written by the CivSec S.M.A.R.T team

We build and run websites, software and AI systems for businesses. We write about what we see in that work, in plain language, and we update articles when things change.

Last checked . Spotted something outdated? Tell us.

Frequently asked questions

Is having a person approve everything the safest option?

It is the slowest and often not the safest, because a person approving hundreds of routine cases stops reading them. Safety comes from placing human attention where it changes outcomes: irreversible decisions, decisions about people, unusual cases, and a sample of the routine. Everywhere else, automatic with logging and sampling is both faster and better overseen.

What decisions should never be automated?

Decisions that significantly affect a person and cannot be easily reversed: hiring, firing, credit, access to services, medical or legal conclusions. In many jurisdictions the law also requires meaningful human involvement in decisions like these. The system may prepare, summarise and recommend; a person decides, with the evidence in front of them and the authority to decide differently.

How do we know the oversight is real and not a formality?

Look at the log. If the person changes or rejects a meaningful share of proposals, oversight is working. If approval is instant and unanimous for months, either the system is perfect, which is unlikely, or the reviewer has stopped reviewing. Rotate reviewers, sample the approvals, and make the evidence visible on the review screen.