AI Control Library / CF-07: Human Oversight & Escalation
Designation: Core | Control types represented: Operational and Technical
Control requirement
Define human oversight for the complete agentic workflow, covering planning, delegation, tools, persistent work and cumulative effects. Ensure humans can understand relevant state and constrain or stop consequential activity across the assessed boundary.
Why this matters
Supervising the parent agent does not necessarily control its child workers or queued actions. Oversight must follow delegated authority and continuing activity rather than the visible conversation alone.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Single and multi-agent systems capable of consequential action, persistent execution, tool use or task delegation.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The agentic service owner is accountable; orchestration, security and operations teams implement visibility and intervention.
Implementation guidance
- Map agents, tools, permissions, delegation and persistent work, identifying consequential decisions and cumulative risk.
- Define where human approval, monitoring, escalation and termination apply, with usable views of state and outstanding actions.
- Enforce boundaries through orchestration and tool controls, propagating restrictions and stopping across delegated work.
- Exercise compound and partial-failure cases, verifying human authority and reconciliation of irreversible effects.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Delegate a consequential task | Oversight follows the child’s actual authority and actions. |
| Stop or restrict the parent | Required restrictions propagate to continuing work. |
| Review a compound outcome | Humans can identify material steps and intervene at the approved boundaries. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Agent and delegation map
- Oversight and action-gate design
- Distributed intervention tests
- State and outcome records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Contain uncontrolled delegated or persistent activity and notify security and the service owner. Account for outstanding effects before restoring execution.
Example in practice
Hypothetical example: A research agent delegates outreach to a worker. Oversight requires approval at the messaging boundary and makes the worker’s queue visible, so stopping the parent does not leave outbound messages running.
Related controls
- CF07-006: AI System Kill Switch & Emergency Stop
- CF14-004: Inter-Agent Trust & Communication Security
- CF14-009: Multi-Agent Orchestration Security
Framework mappings
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0