AI Control Library / CF-07: Human Oversight & Escalation
Designation: Core | Control types represented: Operational and Technical
Control requirement
Define and enforce AI autonomy limits by task, action, data, resource, duration and delegation as appropriate. Require reviewed authorization before the system gains materially greater authority.
Why this matters
An autonomy label such as supervised does not specify the permissions available to the system. Boundaries must constrain actual behavior, including accumulation of individually permitted steps into a consequential outcome.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
AI agents and workflows that can plan, select tools or act with varying levels of human approval.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The business owner approves autonomy; engineering and security implement limits and operations monitors exceptions.
Implementation guidance
- Define permitted tasks, tools, identities, data scope, spending or resource budgets and delegation conditions.
- Assign human gates and explicit escalation for actions or uncertainty outside scope, with safe termination behavior.
- Enforce constraints at tool and resource boundaries, preventing the model or delegated worker from granting itself more authority.
- Test combined actions, delegation and changes in permissions, revisiting limits after capability or use changes.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Attempt an out-of-scope action | Independent enforcement prevents it. |
| Delegate a task | The child receives no broader authority than approved. |
| Combine repeated allowed actions | Aggregate limits and relevant review gates still apply. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Autonomy and permission specification
- Enforcement configuration
- Boundary and delegation tests
- Change and exception decisions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Contain unexpected authority expansion and notify system and security owners. Reassess capabilities and completed actions before restoring the approved scope.
Example in practice
Hypothetical example: A purchasing agent may compare suppliers but cannot place orders. A plugin update that enables checkout remains blocked until a new autonomy decision and relevant controls are approved.
Related controls
- CF07-002: Human Review Gates for Consequential Decisions
- CF14-003: Agentic Scope Containment
- CF14-011: Excessive Agency Prevention
Framework mappings
- CSA AICM
- NIST AI RMF (GOVERN 5.1)
- EU AI Act (Art. 14)
- ISO 42001 (Cl. 8.2, A6.1)
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Human Oversight & Escalation
Version 1.0