At first, the risk committee's answer sounded impeccable: every agent action would wait for a person. Customer updates, price corrections, supplier messages, configuration changes and payment instructions all acquired an approval gate. The daily queue soon reached into the thousands. Reviewers opened the same thin evidence panel, accepted routine items and learned that delay was punished while agreement was rewarded. A small beneficiary change then arrived near the end of a long shift. Its polished rationale looked familiar. The reviewer approved it without opening the contradictory bank record. The organisation had added humans everywhere and placed judgement almost nowhere.

The failure was not caused by a uniquely careless individual. The control architecture consumed attention as if attention were infinite. Every request carried a context-reconstruction cost. Repetition trained the reviewer to expect harmlessness. Queue age made speed feel like the objective. The agent's recommendation anchored the decision before independent thought began. A nominal approval remained in the audit trail, yet the conditions for meaningful review had disappeared.

01 · The scarce resourceWhen visible control becomes attention debt

Approval attention is the capacity to understand a proposed action, reconstruct its context, inspect relevant evidence, challenge a recommendation and take responsibility for the decision. It is narrower than staffing and richer than elapsed review time. Two reviewers with an identical queue may have different useful capacity because one holds the relevant mandate and domain competence while the other must search for basic context. Capacity also changes during a shift as interruptions, repeated patterns and unresolved exceptions accumulate.

Bainbridge's automation irony remains sharp: removing routine activity can leave people with rare, difficult monitoring and takeover tasks. Endsley and Kiris linked high automation with losses in situation awareness and poorer takeover performance in their experimental setting. These findings do not mean people should retain every manual step. They mean an operating design must preserve the information, practice and authority needed when intervention matters.

A flood of individually reversible CRM enrichment requests illustrates the mechanism. Each update looks harmless. Thousands of approvals create interruption and pattern pressure. Buried among them are a few actions that change account ownership or contact permissions. Universal approval gives every item the same visual ceremony and steals discrimination from the reviewer. The better design executes strictly bounded enrichment, samples its effects, and reserves an interrupt route for changes to rights, money or customer standing.

The architecture must also distinguish an approval from an exception. An approval asks a person to decide within an established mandate. An exception asks whether the mandate itself should stretch. Mixing both in one queue encourages reviewers to treat a policy departure as another routine item. Exceptions need their own lane, a named authority and a record of which rule is being displaced. Repeated exceptions are evidence that the base policy or product needs redesign, not evidence that reviewers should become faster.

Attention debt can be carried forward. A reviewer who clears an old queue today may begin tomorrow with unresolved investigations, weak outcome feedback and less confidence about recent rule changes. Capacity planning should therefore consider open complexity as well as item count. A small queue containing novel cases can consume more judgement than a large queue of well-bounded samples. The ledger should record estimated reconstruction effort and the number of unresolved branches so that staffing and routing respond to real work.

02 · Strong rivalWhy universal approval sometimes works, then fails

Requiring approval for every action has a legitimate place. During a short learning phase, it reveals action variety and missing safeguards. It can also be appropriate for a narrow population of irreversible, high-consequence acts. The rival becomes weak when it is treated as permanent proof of safety. A person without mandate cannot authorise. A person without evidence can only endorse a presentation. A person who cannot affect the outcome is a witness, not a control.

Parasuraman, Sheridan and Wickens separated automation across information acquisition, analysis, decision selection and action implementation. That distinction matters here. An agent may gather evidence automatically while a person selects the decision, or a person may define a rule while software implements thousands of bounded actions. “Human approval” obscures these allocations. The operating question is which stage needs judgement, what information makes judgement possible, and whether delay changes the risk.

The opposite shortcut is equally dangerous. Teams may label a route “sampling” or “batch review” because they do not want to staff an actual obligation. A reversible action can still create cumulative harm. A sample can arrive after recovery is no longer possible. A batch can combine correlated errors. The route must follow credible consequence, containment, detection lag and capacity, rather than the convenience of the delivery team.

Timing changes the meaning of control. A review that occurs before an action can prevent it. A review after a reversible action can detect and repair it. A review after an irreversible settlement can only support investigation and remediation. Calling all three “human oversight” hides their different powers. The route receipt should state whether the person can prevent, pause, reverse, contain or merely learn from an outcome. Senior committees can then see when a proposed control cannot deliver the protection claimed for it.

Universal approval also transfers operational reliability to the human queue. Holidays, incidents, time zones and staff turnover become failure modes for the automated service. A defensible design specifies what happens when the approver is unavailable. Low-consequence work may remain inside a reduced automatic envelope. Consequential work may stop safely. Quietly substituting an untrained manager, allowing a request to expire into execution or accumulating a hidden backlog is not a continuity plan.

03 · Original constructTwo ledgers, one routing surface

The approval-attention control surface starts with two coupled ledgers. The action ledger describes what may happen in the world. It records the affected population, maximum credible consequence, breadth, reversibility, containment, recovery time, novelty, policy ambiguity, uncertainty, evidence provenance, counter-signals, recurrence, cumulative exposure, correlated failure, deadline and cost of waiting. Maximum credible consequence is distinct from average predicted loss. A rarely wrong payment action can still deserve live independent approval because one error is difficult to repair.

The attention ledger describes whether meaningful human review exists now. It records the named reviewer and mandate, competence, independence, conflicts, queue depth, oldest-item age, estimated reconstruction and review time, interruption load, recent disagreement and overrides, evidence actually opened, consecutive load, scheduled recovery, unassisted calibration and downstream escape findings. It is an operating record, not a performance score for individuals.

The ledgers should not be converted into a maturity number, traffic-light average or model confidence score. A high consequence cannot be averaged away by excellent reviewer staffing. Missing provenance cannot be offset by a short queue. Preserve the individual facts, applicable threshold, counter-evidence and residual uncertainty. If a route changes, the audit trail should show which condition changed.

The action ledger begins before a user sees a recommendation. Product owners define the largest object the agent can affect, the populations it must never touch, the maximum rate and total exposure, the permitted sources, the tools it can invoke and the state required for recovery. Runtime evidence then shows whether the particular action stayed inside that design. This prevents a reviewer from having to infer the entire authority model from a natural-language request.

Maximum credible consequence requires an explicit scenario. “Material” should resolve into an affected customer, cash position, service, employee, regulatory duty or safety state. The scenario states how error propagates, when it becomes visible and what repair would require. This anchors the route in an observable claim. It also exposes cases where a nominally reversible database update has already triggered an external message, downstream payment or irreversible customer decision.

The attention ledger needs comparable discipline. Queue depth should be segmented by consequence lane and verification complexity. Evidence-opened data should distinguish a primary record from a summary panel. Override data should include the reason and eventual outcome, while disagreement should include cases where the human's provisional view changed after legitimate new evidence. The purpose is to test the control design. It is not to reward agreement with the agent or to penalise cautious reviewers.

04 · Control architectureFive routes instead of one gate

A fast reversible operational response belongs on the sample path when its bounded action prevents larger loss and can be rolled back within minutes. Waiting for a queue may create the harm the control is meant to prevent. The system should execute inside a hard envelope, preserve its state change, alert on boundary breaches and place a sample in rapid audit. If recovery slows or scope expands, the route changes.

Batch review suits patterns. Ten proposed catalogue corrections can be reviewed together against a common policy and source set. The reviewer can compare outliers, inspect cumulative exposure and release or reject the set. Individual interruptions would destroy this comparative advantage. A batch must still have a maximum size, age, competent owner and safe default when the window is missed.

Route design should make escalation selective. A sample that reveals a boundary breach may interrupt immediately, while a minor documentation defect can wait for the next batch. A live approver may narrow an action instead of choosing only accept or reject. For example, a broad refund proposal can become one bounded customer repair with follow-up investigation. The interface should offer these control moves directly and preserve the difference between the proposed and authorised action.

Route changes must be atomic. If an evidence source becomes unavailable between review and execution, the prior approval cannot remain valid. If the queue becomes saturated after a high-consequence request is raised, the system cannot silently downgrade it to batch review. Bind the receipt to the evidence version, authority version, action parameters and expiry. Re-evaluate when any of those facts change, and fail to a pre-agreed safe state.

Automatic execution still requires human ownership. A control owner sets the envelope, reviews monitoring, accepts the residual exposure and can suspend the route. The absence of a synchronous click does not mean the absence of governance. In many high-volume, low-consequence settings, carefully constrained execution with good receipts gives management more visibility than repetitive approvals that nobody can substantively perform.

05 · Workload engineeringThe reviewer-capacity waterfall

Review time begins before the evidence panel opens. A reviewer locates the affected case, reconstructs its prior state, identifies the decision mandate, reads primary evidence, considers contrary signals, decides, records reasons and recovers from the interruption. An interface that reports only click duration systematically understates control cost. It also rewards shallow review.

Queue controls should be structural. Cap the number of consecutive high-complexity cases. Route similar items into scheduled blocks. Protect a reviewer from parallel operational duties during a live decision. Rotate after defined loads and provide a second reviewer for conflicts or unusually high consequence. These are safer than attempting to infer fatigue from webcam behaviour, keystroke rhythm or physiology.

A flooding attack exploits the waterfall. An actor or malfunction produces plausible low-level requests until review behaviour becomes automatic, then inserts a harmful action. Defence begins with rate limits, source identity, deduplication, request-shape monitoring and separate lanes for consequence. The queue should never give a flood permission to change the reviewer allocated to a treasury instruction. If saturation invalidates the planned control, high-consequence action stops rather than waiting behind the flood.

Service-level targets should separate speed from sufficiency. A target such as “approve within five minutes” can make delay visible but says nothing about whether five minutes permits reconstruction. For each action class, estimate the minimum useful review work and reserve capacity accordingly. When actual demand exceeds that capacity, the answer is rerouting, added competence, narrower authority or suspended action. Compressing the same cognitive work into a shorter interval only hides the shortage.

Reviewer assignment should follow competence and independence before availability. A person who understands the domain but created the underlying request may be conflicted. A detached reviewer may lack the context needed to notice a false premise. The operating model can pair these strengths: a domain preparer assembles the record, while an independent authorised person makes the decision and can question the preparer's assumptions. Both identities and roles belong in the receipt.

06 · Meaningful oversightThink before the recommendation arrives

Independent judgement changes the sequence of the interface. The reviewer first sees the decision frame, primary facts and applicable mandate. They record a provisional assessment. Only then does the system reveal the agent's recommendation and rationale. The reviewer inspects counter-evidence, reconciles differences and records the final decision. This does not guarantee accuracy. It creates evidence that the person formed a view rather than merely accepting an anchor.

Buçinca, Malaya and Gajos found that cognitive forcing functions reduced overreliance in their experiment, with a subjective-cost trade-off. Bansal and colleagues found in their studied tasks that explanations increased acceptance without improving complementary team performance. These results do not justify one universal interface. They do justify testing whether a design prompts active analysis and measuring whether that benefit survives the real workload.

An explanation placebo occurs when a polished rationale increases acceptance despite incomplete provenance. The remedy is not a longer explanation. Require the primary evidence, identify what would disconfirm the recommendation, and make missing sources visible before approval. A confidence percentage should never replace source quality or uncertainty about the decision boundary.

Skill preservation belongs inside the control. Reviewers should periodically complete representative cases without the AI recommendation, receive outcome feedback and discuss disagreements. Overrides alone are a poor skill measure: a reviewer may correctly agree with a strong system for months. Unassisted calibration shows whether domain understanding and manual recovery remain available. It must be designed as learning, not as a hidden employee-ranking mechanism.

Challenge prompts should be specific to the decision. “Are you sure?” quickly becomes another click. Better prompts ask which source supports the beneficiary identity, what evidence conflicts with the recommendation, whether cumulative exposure remains within the mandate, or what state will prove rollback. The prompt must point towards a verifiable fact without steering the reviewer to a preferred answer. Where no useful challenge can be written, the team may not yet understand the decision well enough to automate it.

Disagreement is valuable control data. A person who changes their provisional view after opening strong evidence is not inconsistent. An agent that repeatedly changes reviewers' views in one direction may be informative, persuasive or systematically anchoring. Sample the underlying correctness and affected populations before interpreting the pattern. Review meetings should examine disagreement cases with outcomes, not celebrate a high acceptance rate.

07 · Worked caseThe beneficiary and the payment

A treasury agent proposes a new beneficiary and a large payment. The action is financially consequential, broad enough to affect cash and fraud exposure, and hard to reverse after settlement. The source package includes an invoice, contract reference and apparent bank letter. One bank-account record lacks verified provenance. The action ledger therefore rejects automatic, sample and batch routes.

Live approval is available only when a competent treasury approver holds the mandate, is independent from the beneficiary-creation chain, can inspect verified bank evidence, and has enough time to challenge the case. Segregation of duties matters because the same person should not both establish the beneficiary and release the payment. An approval from an overburdened general manager does not repair the missing control.

If verified evidence cannot be reconstructed before the deadline, the payment stops. Urgency does not create authority. The business may use an authorised alternative process, correct the beneficiary record or renegotiate timing. The retained evidence includes the proposed action, source artefacts, identities, provisional human judgement, agent recommendation, counter-signals, reviewer decision, disagreement and final state.

Now change the example. A configuration agent detects a low-consequence service fault and can restore the previous setting automatically within minutes. Waiting for the treasury approver would increase outage loss without adding relevant expertise. The correct route is bounded execution followed by a short-lag sample, with a hard rollback and an interrupt if the action spreads beyond the named service. The human role changes because the action, recovery and deadline changed, not because the agent became more trustworthy.

08 · Interactive instrumentApproval Routing and Attention Console

The Console below is a policy conversation made executable. It does not issue a quality score. It exposes which facts route the action and what control evidence must remain. Use the presets to exercise all five routes, then alter one condition at a time. In production, thresholds must be set by the accountable business, risk and operational owners.

09 · Operating disciplineProve that the control still works

A control owner should review routing thresholds on a fixed cadence and after material incidents. Useful measures include the proportion of evidence opened, disagreement before and after advice, override reasons, queue age by consequence lane, sampling findings, escaped errors, recovery time, abandoned approvals and unassisted calibration performance. Acceptance rate alone is ambiguous. High agreement may reflect excellent recommendations or passive endorsement.

Sampling should combine random selection, risk-shaped selection and correlated-cluster review. Random sampling estimates ordinary performance. Risk-shaped sampling looks harder at novelty, borderline evidence and changed populations. Cluster review detects common-mode failure across many individually modest actions. Every sample needs a defined audit lag and a recovery mechanism that remains usable when the finding arrives.

Feedback closes the loop only when it reaches the people who can change the system. A sampled error should update the affected case, action boundary, evidence design, reviewer guidance and training set where appropriate. A live approval that prevented harm should reveal which signal mattered. A stopped action should produce a redesign owner and due date. Otherwise, the organisation accumulates audit findings while the queue recreates the same work.

Control health should be reviewed by route, not in aggregate. A low overall escape rate can conceal a failing live-approval lane. A rising acceptance rate may be harmless in bounded execution samples and alarming in novel policy exceptions. Compare each lane with its claimed protection: prevention for live approval, timely detection and recovery for sampling, comparative judgement for batches, boundary compliance for automation, and successful remediation for stops.

Changes to models, evidence providers, interfaces, authority policies or staffing can invalidate an existing route. Treat these as control changes requiring revalidation. A more capable model does not automatically justify fewer approvals, and a new explanation panel does not prove better scrutiny. Run representative cases, including known errors and flooding patterns, then observe decision quality, review work and recovery before expanding authority.

The reviewer must be allowed to disregard, override or stop the system. The EU AI Act sets specific human-oversight requirements for high-risk systems, including competence, authority, awareness of automation bias and the ability to intervene. Its legal scope should not be generalised to every workflow, but its precision is useful: meaningful oversight depends on capability and power, not a decorative presence.

NIST's AI RMF distinguishes roles across those who build, use, manage and oversee AI. An enterprise can turn that distinction into named control ownership. Product teams own the action envelope and evidence interface. Operations owns queue design and service continuity. Risk and compliance set consequence thresholds and independent-review obligations. Business owners accept residual exposure. Internal audit tests whether the recorded route matches actual practice.

Approval without fatigue does not remove people from consequential decisions. It stops wasting them on requests where a bounded system, sample or batch provides stronger control. It also refuses the fiction that a human can repair missing evidence, invalid authority or an impossible queue by clicking faster. Attention is allocated, protected, refreshed and evidenced. Leaders can then defend both the actions they interrupted and the routine actions they deliberately allowed to proceed. Where those conditions cannot be met, the correct route is to stop and redesign.

SourcesReferences

1. Bainbridge, L. (1983), “Ironies of Automation”, Automatica, 19(6), 775–779. doi.org/10.1016/0005-1098(83)90046-8.
2. Parasuraman, R., Sheridan, T. B. and Wickens, C. D. (2000), “A Model for Types and Levels of Human Interaction with Automation”, IEEE Transactions on Systems, Man, and Cybernetics, Part A, 30(3), 286–297. doi.org/10.1109/3468.844354.
3. Parasuraman, R. and Riley, V. (1997), “Humans and Automation: Use, Misuse, Disuse, Abuse”, Human Factors, 39(2), 230–253. doi.org/10.1518/001872097778543886.
4. Endsley, M. R. and Kiris, E. O. (1995), “The Out-of-the-Loop Performance Problem and Level of Control in Automation”, Human Factors, 37(2), 381–394. doi.org/10.1518/001872095779064555.
5. Skitka, L. J., Mosier, K. L. and Burdick, M. (1999), “Does Automation Bias Decision-Making?”, International Journal of Human-Computer Studies, 51(5), 991–1006. doi.org/10.1006/ijhc.1999.0252.
6. Parasuraman, R. and Manzey, D. H. (2010), “Complacency and Bias in Human Use of Automation: An Attentional Integration”, Human Factors, 52(3), 381–410. doi.org/10.1177/0018720810376055.
7. Lyell, D. and Coiera, E. (2017), “Automation Bias and Verification Complexity: A Systematic Review”, Journal of the American Medical Informatics Association, 24(2), 423–431. doi.org/10.1093/jamia/ocw105.
8. Buçinca, Z., Malaya, M. B. and Gajos, K. Z. (2021), “To Trust or to Think: Cognitive Forcing Functions Can Reduce Overreliance on AI in AI-Assisted Decision-Making”. arxiv.org/abs/2102.09692.
9. Bansal, G. et al. (2021), “Does the Whole Exceed its Parts? The Effect of AI Explanations on Complementary Team Performance”. arxiv.org/abs/2006.14779.
10. Alon-Barkat, S. and Busuioc, M. (2023), “Human-AI Interactions in Public Sector Decision-Making: Automation Bias and Selective Adherence to Algorithmic Advice”. arxiv.org/abs/2103.02381.
11. De-Arteaga, M., Fogliato, R. and Chouldechova, A. (2020), “A Case for Humans-in-the-Loop: Decisions in the Presence of Erroneous Algorithmic Scores”. arxiv.org/abs/2002.08035.
12. Turan, E. (2026), “Oversight Has a Capacity: Calibrating Agent Guards to a Subjective, Fatiguing Human”. arxiv.org/abs/2606.08919.
13. NIST (2023), “AI Risk Management Framework Core”. airc.nist.gov/airmf-resources/airmf/5-sec-core/.
14. NIST (2023), “Appendix C: AI Risk Management and Human-AI Interaction”. airc.nist.gov/airmf-resources/airmf/appendices/app-c-ai-risk-management-and-human-ai-interaction/.
15. Autio, C. et al. (2024), Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. doi.org/10.6028/NIST.AI.600-1.
16. European Union (2024), Regulation (EU) 2024/1689, Article 14. eur-lex.europa.eu/eli/reg/2024/1689/oj.
17. ISO/IEC (2023), ISO/IEC 42001: Artificial intelligence management system. iso.org/standard/42001.