In the new episode of Bitrock Tech Radio, we revisited Agentic AI, starting from a question that many companies are already asking themselves: if AI agents work autonomously, what is left for humans to do? The episode focused on the shift from Human-in-the-loop to Human-on-the-loop, guided once again by Michele Ridi, Chief Strategy & Presale Officer at Fortitude Group.
Inside the Loop or Above the Loop?
Curiously, these two expressions originate from the military world: they were used as early as 2012 in a U.S. Department of Defense directive on autonomous systems. Outside that context, the difference is easy to grasp. Being in the loop means that the machine proposes and the person authorizes every single step; until the green light is given, nothing moves. Being on the loop means letting the machine operate within defined boundaries, monitoring what happens, managing exceptions, and retaining the ability to stop everything at any moment.
With the first Generative AI tools, we were in the loop almost without realizing it: we asked a question, read the answer, and decided what to do with it. Agents, however, have changed the game.
An agent reasons in terms of tasks and carries out a job from start to finish. It reads, calls tools, writes, and often performs multiple actions before reaching the result. If we ask for approval at every step, one of two scenarios unfolds: either the work slows down to the point that the agent becomes useless, or the user ends up clicking “yes” without reading.
Anthropic noticed an interesting behavior: more experienced users let the agent work automatically much more often than others do, but they are also the ones who interrupt it most frequently. Without anyone telling them to, they transition from approving everything to letting the agent act, stepping in only when needed.
Gartner points in the same direction: forecasts suggest that by 2028, at least 15% of daily operational decisions will be made autonomously by agentic systems. When AI truly enters workflows, processes naturally move this way.
Who Stops the Agent When It Makes a Mistake?
Here lies the problem. In the in-the-loop model, there is a hard stop: without our “yes,” the action does not execute. In the on-the-loop model, for the vast majority of actions, that gate no longer exists—and if it is not replaced by something else, the risk increases.
The Replit Case
What happened at Replit, an American online development platform, illustrates this well. In July 2025, Jason Lemkin, a well-known entrepreneur and investor in the SaaS world, was building an application using the platform’s agent. In his prompts, he had repeatedly declared a code freeze—a direct instruction not to touch anything.
The agent deleted the production database and then claimed there was no way to roll it back—which was actually false. Because it was a test app, the data was recovered and the damage remained limited.
The underlying mechanism, however, is clear. The prohibition was written in natural language inside the prompt, and no technical control prevented the agent from accessing production. Replit’s CEO stated that such an occurrence should not have been possible, yet it happened. The remedy was technical: the automatic separation between development and production environments. It is hard to find a clearer example of what can happen when an agent has full autonomy.
When the Human Isn’t Even Involved
In other cases, no one is consulted at all. EchoLeak, a vulnerability discovered in 2025 in Microsoft 365 Copilot, allowed sensitive data to be exfiltrated via a specially crafted email, without requiring the user to click anything. There was simply no one to ask for authorization.
From these episodes emerges a rule that is easy to state but much harder to apply: an instruction is not a control. It is no coincidence that Gartner cites inadequate risk controls as one of the main reasons why over 40% of agentic projects will be canceled by the end of 2027. Many companies still lack a control culture designed specifically for agents.
The Hard Stop Shifts to the Infrastructure
If humans no longer oversee every single step, the hard stop does not disappear: it changes position, moving from a person’s click down to the infrastructure.
A useful analogy is an airport control tower. Air traffic controllers do not fly the planes, but they see all routes, know safety corridors and distances, and can intervene as soon as an aircraft strays off course. In our world, this means having a single control point through which all traffic between agents, models, and tools passes. At that point, rules are applied deterministically: establishing what data can leave, which tools the agent can call, how many tokens and budget it can consume, and what happens when a guardrail is triggered.
Everything can and should be logged there, because without traces, only blind trust remains. It is also from this point that the signal to recall a human originates when necessary—such as when facing an irreversible action, a breached threshold, or anomalous behavior.
This is the job of AI gateways, and it is how we built ours at Radicalbit: a proxy between applications and models featuring guardrails against personal data leakage and prompt injection, rate and budget limits, and end-to-end tracing. We also developed an MCP proxy that extends the same level of control to tool calls, available as open-source software. For a component designed to guarantee control, transparency is vital, as it allows verification prior to production rather than discovering its limits after an incident.
Regulations are heading in the same direction. The European AI Act does not demand approval for every single step; it requires supervision that is proportional to the system’s level of autonomy.
From this perspective, knowing how to recognize anomalies is equivalent to having a real kill switch, a red button that returns the system to a safe state. What truly matters is the ability to intervene effectively when needed, and being able to prove it.
For high-risk systems, obligations have been pushed to December 2027. Rather than a delay, this is our window to prepare: designing autonomy, translating it into technical constraints, and equipping ourselves with observational tools are tasks that take months.
New Skills for Those Supervising Agents
Technology aside, there is an aspect that tends to be underestimated. At first glance, on-the-loop seems to strip work away from people, as if humans were left with mere surveillance while automation handles the rest. In reality, it changes the required skill set, demanding higher qualifications than before. At least four key capabilities come into play:
Designing Autonomy
Someone must analyze processes and classify their constituent actions: which can be undone and which cannot, which carry economic or reputational impacts, and which touch sensitive data. Based on this map, organizations decide where the agent proceeds on its own, where it stops to ask, and where it must never go. This work bridges business needs, domain expertise, risk management, architecture and no model vendor can do it on a company’s behalf.
Translating Rules into Technical Constraints
Organizations need people capable of writing policies, configuring guardrails, and managing agent identities and permissions. This profile sits at the intersection of security, platform engineering, and compliance—a cross-functional role that is often lacking in organizations today.
Knowing How to Observe
Supervisors must know how to interpret traces, metrics, and cost alerts, and above all, how to set thresholds. Too many alerts recreate the fatigue of step-by-step approval, merely shifted onto a dashboard. Too few, and problems surface at the end of the month when invoices arrive and spending limits have already been blown.
Retaining the Ability to Intervene
The final skill is perhaps the most human, concerning the capacity to step in when it truly matters. It is also the source of the most compelling reflection.
The Irony of Automation
Cognitive psychologist Lisanne Bainbridge defined the irony of automation: the more a system is automated, the more operators lose their touch precisely in the situations where intervention is required. The paradox is that delegating to a machine frees up time and attention, but gradually erodes the very skills needed on the day that delegation fails.
In corporate environments, this dynamic necessitates preserving domain expertise and nurturing critical judgment, because automation bias—the tendency to trust the machine even when it is wrong—affects experts too.
Over the last two to three years, the first studies examining the effects of AI-driven automation have begun to emerge, with radiology being one of the first fields investigated. In a peer-reviewed study, experienced radiologists presented with an incorrect AI suggestion saw their correct assessment rate drop from over 80% to less than half.
This statistic speaks volumes about where humans should be positioned. Humans perform at their best when evaluating an agent’s overall plan, whereas validating individual commands often degrades into mere rubber-stamping. This is why, when working with clients, our scope extends beyond the gateway: we focus on the platform, the data streams supplying real-time signals, and the people operating inside that control tower.
Conclusions
The transition from in the loop to on the loop is already underway, whether companies plan for it or not. Agents push in that direction, and anyone trying to hold them back with step-by-step approvals either slows them down or ends up approving without looking. The question remains how to do it without losing control.
From all this, three levels emerge that must be kept together: an infrastructure that applies rules deterministically, a regulatory framework that requires proportional and demonstrable supervision, and people with new skills capable of designing, observing, and intervening.
To those about to put their first agent into production, a piece of advice: before asking how good the agent is, how many things it knows how to do, and how well it does them, it is worth asking who is observing it, and with what tools it is being observed and controlled.
Humans do not leave the loop, they step up: they stop being the bottleneck that always says yes in the end and become the control tower.
At Bitrock, we are committed to supporting companies in governing Agentic AI in a safe and compliant way, also thanks to our proprietary Radicalbit platform. Contact us for a personalized consultation.