AI Control Library / CF-07: Human Oversight & Escalation
Designation: Core | Control types represented: Operational and Technical
Control requirement
Provide authorized personnel with a tested means to suspend consequential AI activity and reach a defined safe state independently of the model’s cooperation. Cover delegated work, queues and retries, verify completion and control restoration.
Why this matters
Closing a chat window may leave workers and child agents active. Effective stopping interrupts the ability to cause further harm, identifies outstanding effects and distinguishes a stop request from confirmed containment.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
AI systems whose outputs or actions can materially affect people, data, transactions or infrastructure, including managed services through customer-controlled boundaries.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The system owner defines safe state and authority; engineering and security implement enforcement, and operators activate and verify it.
Implementation guidance
- Map action paths, dependencies and irreversible operations; define a safe state and maximum stopping time justified by potential harm, including a controlled transition for physical or essential services.
- Enforce stopping outside the model by suspending execution, blocking relevant tool access and containing schedules, delegated work and retries.
- Provide accessible authorized activation and an alternate route; confirm that required activity has ceased and report incomplete stopping.
- Reconcile completed and outstanding actions and require authorized restoration after cause, residual risk and recovery conditions are assessed.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Stop active consequential work | The approved safe state is verified within its defined tolerance. |
| Include queued, delegated and retry paths | Activity does not continue or restart automatically outside the accepted conditions. |
| Make the model or primary console unavailable | Independent stopping remains available and restart requires authorization. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Safe-state and stopping procedure
- Action-path and enforcement map
- Timed stopping and restart tests
- Incident and restoration records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Immediately notify incident response and the system owner if stopping fails or cannot be verified. Apply approved alternate isolation, preserve evidence and maintain restrictions until safe recovery is authorized.
Example in practice
Hypothetical example: A refund agent stops at its dashboard, but a child worker continues submitting payments. The test fails. Shared payment authorization is then blocked independently, outstanding transactions are reconciled and all execution paths are retested.
Related controls
- CF07-005: AI Decision Override Mechanisms
- CF14-008: Agentic Task Scope & Graceful Termination
- CF09-011: Agentic System Action Monitoring
Framework mappings
- CSA AICM
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14(1))
- ISO 42001 (Cl. 8.2, A6.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0