AI Control Library / CF-07: Human Oversight & Escalation
Designation: Core | Control types represented: Operational and Technical
Control requirement
Enforce human review gates before specified consequential AI decisions or actions take effect. Bind approval to the relevant action, scope and evidence, and prevent bypass, replay or substitution after approval.
Why this matters
A confirmation screen offers little protection if a background path can execute the same action without approval. Review must govern the actual action rather than an earlier summary that the agent can subsequently change.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Consequential tool calls, decisions and releases requiring prior human authorization, including batch and delegated execution.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The decision owner defines gates; engineering enforces them and authorized reviewers assess the proposed activity.
Implementation guidance
- Define gated actions and risk conditions, including delegated, repeated and combined activity.
- Present the information needed to approve or reject, identifying proposed targets, data, effects and material uncertainty.
- Enforce approval outside the model, binding it to the action parameters, validity and authorized identity.
- Test denial, unavailable reviewers, changed parameters and alternate execution paths, preserving decision and outcome records.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Attempt a gated action without approval | Every relevant execution path prevents it. |
| Change material parameters after approval | The old approval cannot authorize the changed action. |
| Deny or time out a review | The system follows its approved hold or fallback behavior. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Gate criteria and authority
- Approval-binding configuration
- Bypass and substitution tests
- Review and execution records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate bypass or ineffective authorization to security and the decision owner. Suspend the affected action path while assessing completed actions and restoring enforcement.
Example in practice
Hypothetical example: A reviewer approves a refund for a stated amount and recipient. Changing either requires new approval; the agent cannot reuse the earlier authorization for a larger payment.
Related controls
- CF07-001: Human Oversight Policy & Procedures
- CF04-014: AI Decision Record & Traceability
- CF14-011: Excessive Agency Prevention
Framework mappings
- CSA AICM
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14(1))
- ISO 42001 (Cl. 8.2, A6.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0