Who holds the veto, and for how long

Authority · June 29, 2026 · 6 min read

Human-in-the-loop and human-on-the-loop are normally written into a policy annex as though they were categories of system. They are not categories. They are claims about timing, and each one is either satisfied or violated by numbers that live in the software.

In-the-loop means the human is a required element of the control path: the machine proposes, the human acts, and the loop’s period therefore includes human latency. On-the-loop means the machine acts and the human may intervene: authority takes the form of a veto held open for a window. Stated that way, the engineering questions are obvious and rarely asked. How long is the window? Who chose that length, against what evidence? What happens at the end of it, and can the operator tell that it has closed?

A veto that cannot be exercised inside its window is not authority. It is paperwork that will be read out later by someone establishing what the operator was responsible for. Four conditions have to hold simultaneously for it to be real. The operator has to be notified before the action, with lead time measured from the moment the notification is perceptible rather than the moment it is queued. They have to be given enough to judge with — not the conclusion alone, but whatever the conclusion was drawn from, in a form that can be assessed faster than it can be re-derived. There has to be a control path that actually preempts, meaning the intervention has priority over the pipeline it is interrupting rather than joining the back of the same queue. And the intervention itself has to be safe to issue: on a moving platform, a stop is a manoeuvre with its own dynamics, not a pause button, and an operator who has been told they can always stop it has been told something slightly false.

Human response is a distribution, not a constant. It has a long tail, and the tail is where the interesting cases are. It also is not a property of a person — it is a property of a person in a situation. Noticing, orienting, comprehending, deciding and acting each take time, and the first two collapse almost to zero when the operator was already attending to that vehicle and expand dramatically when they were attending to something else. This is why span of control is not a staffing preference. If each platform raises events at some rate, and each event costs a bounded slice of attention, then the maximum number of platforms per operator falls out of arithmetic. The arithmetic only holds if the event rate is bounded by design. In most systems it is not: events are emitted whenever a subsystem thinks something is worth saying, so the rate is a function of the environment, and the environment is exactly what becomes busy at the moment supervision matters most.

Sort by reversibility, not by label

The loop-position vocabulary flattens a distinction that does most of the real work: whether an action can be undone, and what it costs if it was wrong.

Those two properties, plus the latency the situation permits, are enough to derive an authority allocation rather than declare one. An action that is cheaply reversible and time-critical should not be waiting on a human, because the waiting is the risk. An action that is irreversible and expensive to get wrong should not be inside a window short enough to guarantee a rubber stamp, and if the physics of the situation demands a window that short, the correct engineering conclusion is that the system should not be taking that action autonomously in that situation at all. Between those poles sits the interesting region, where the right answer is usually to change the action rather than the authority: decompose an irreversible commitment into a reversible preparation plus a small irreversible step, and put the human at the boundary between them, where their decision time is not competing with the platform’s dynamics.

This is also the framing that survives contact with degraded communications. If the authority allocation is stated as “a human approves X”, it becomes undefined the moment the link is marginal. If it is stated as “X is approved only when a fresh approval is held, and in the absence of one the platform does Y”, it is defined in every link state, including the ones nobody enumerated.

The two failure modes of the human element

A supervising operator fails in two directions and both are measurable from inside the system.

The first is acceptance. When the approval rate approaches unity, the human step has stopped filtering anything; the system is running on-the-loop while documenting itself as in-the-loop. That number is emittable. So is the time from notification to response — if it is consistently far below the time it would take to actually read the supporting information, the step is a reflex rather than a judgement, and the design should either give the operator less to approve or give them longer.

The second is rejection, which gets less attention because it looks conservative. An operator who overrides constantly is not adding safety; they are substituting their own model for the machine’s under time pressure, usually with less data. Both failure modes have the same root: the operator cannot tell which recommendations to trust, because the system offers no calibrated signal about its own competence in the current situation. A confidence number that is not calibrated is worse than none, because it is used.

Handover is the sharpest edge in the whole subject. The natural design — the machine hands control back when the situation exceeds its competence — hands control back at precisely the worst moment, to the person with the least context, at the point where the time available is shortest. Handover has to be triggered on the predicted exit from the operating domain, with enough lead time for the operator to rebuild a picture, and the prediction has to be conservative because being early costs a little and being late costs everything.

And whatever the allocation, exactly one party holds authority at any instant, both parties can name who that is, and the transfer is explicit in both directions. Two-holder states and no-holder states are the classic shape of an accident report: not a component that failed, but a component and a person who each correctly believed the other was flying it.