Skip to content
Back to AI Coding

Human-in-the-Loop Gates

Decide what humans must approve vs delegate: risk tiers and approval points.

WorkflowIntermediate

Why

GitHub's 2024 enterprise survey of 2,000 developers found 97% have used AI coding tools at work, and Stack Overflow's 2024 survey found 76% of developers use or plan AI tools (up from 70%). Full autonomy ships hallucinations; full manual review defeats the speed gain.

Risk-tiered gates (auto-approve low-risk, human-approve high-risk) capture the speed where it's safe and the safety where it matters.

When

Use risk tiers whenever AI touches production code. Skip for throwaway prototypes.

How

1. Tier 1 (auto): docs, tests, formatting — AI commits freely. 2. Tier 2 (review): features, refactors — human reviews diff. 3. Tier 3 (block): security, migrations, public API — human approves plan + diff. 4. Encode tiers in CI (e.g., path-based required reviewers). 5. Log what was auto-merged for audit.

Example

# .github/CODEOWNERS + branch rules /docs/ @docs-bot # tier 1: auto /src/** @backend-team # tier 2: review /src/auth/** @security-team # tier 3: block on plan + diff /migrations/** @dba # tier 3 AI commits docs freely; auth changes need security approval before merge.

Common Problems

  • ⚠Error: Cannot find module 'xxx' → run `npm install xxx` (or `pnpm add xxx`); verify it is in package.json dependencies.
  • ⚠Error: "Command not found: claude" or "cursor" → ensure the binary is on PATH: `which claude` / `which cursor`; reinstall globally if missing.
  • ⚠TypeError: Cannot read properties of undefined (reading 'x') → add a null guard or optional chaining `obj?.x`; trace the undefined source via the stack.

Best Practices

  • ✓Tier by blast radius, not by 'feels risky'.
  • ✓Auto-merge tier 1 with CI; require human approval for tier 3 paths.
  • ✓Measure the outcome with a concrete metric (time saved, defect rate, test coverage) so the practice can be justified and improved.

FAQ

What is Human-in-the-Loop Gates?

Decide what humans must approve vs delegate: risk tiers and approval points. It helps developers quickly grasp the core value and use cases of Human-in-the-Loop Gates.

How do I get started with Human-in-the-Loop Gates?

To get started with Human-in-the-Loop Gates, focus on these points first: Tier 1 (auto): docs, tests, formatting — AI commits freely.

What are common mistakes with Human-in-the-Loop Gates?

Common mistakes when using Human-in-the-Loop Gates include: Error: Cannot find module 'xxx' → run `npm install xxx` (or `pnpm add xxx`); verify it is in package.json dependencies.; Error: "Command not found: claude" or "cursor" → ensure the binary is on PATH: `which claude` / `which cursor`; reinstall globally if missing.; TypeError: Cannot read properties of undefined (reading 'x') → add a null guard or optional chaining `obj?.x`; trace the undefined source via the stack..

What are the best practices for Human-in-the-Loop Gates?

Best practices for Human-in-the-Loop Gates include: Tier by blast radius, not by 'feels risky'.; Auto-merge tier 1 with CI; require human approval for tier 3 paths.; Measure the outcome with a concrete metric (time saved, defect rate, test coverage) so the practice can be justified and improved..

How do I learn more about Human-in-the-Loop Gates?

Start with the official docs, then search real-world examples on GitHub. Validate patterns in a small scratch repo before applying them to production code.