Limit the permissions first
An AI-assisted step should have access only to the data and actions needed for its job. Separate read access from write actions where possible and avoid broad administrator credentials.
Classify the consequence of a wrong output
Drafting an internal summary has a different risk from approving a refund, changing an account or sending legal advice. The higher the consequence, the stronger the review and fallback requirements should be.
Keep human approval around sensitive actions
Define which actions require explicit review, what information the reviewer sees and what happens when the reviewer rejects the suggestion. “Human in the loop” must be an actual operating step, not a label.
Treat external input as untrusted
Documents, emails and web content can contain instructions intended to manipulate AI behaviour. Keep system instructions, tool permissions and validation separate from untrusted source text.
Design for provider failure
Model APIs can time out, rate-limit or change behaviour. Use retries carefully, set timeouts, prevent duplicate actions and define a manual or deterministic fallback.
Log enough to investigate
Record workflow state, tool actions, approvals and errors without unnecessarily storing sensitive content. Logs should help answer what happened and who approved the consequential action.
Review the workflow after launch
Monitor accuracy, failure patterns, provider changes and whether the original business case is still valid. A safe workflow can become unsafe if its scope or dependencies quietly expand.
Questions businesses ask
01What does human in the loop mean?+
A person reviews or approves defined outputs or actions before the workflow proceeds, especially where the consequence of an error is material.
02What is prompt injection?+
It is an attempt to manipulate an AI system through untrusted instructions in user or external content. Tool permissions and validation should not rely on the model ignoring such text.
03Do AI workflows need logs?+
Yes. Production workflows need enough audit information to investigate errors, approvals and system actions while respecting privacy and data minimisation.
