A human in the loop is the correct default. It is also the single most expensive line item in your agent architecture, and almost nobody prices it before they ship.
Here is the pattern I keep seeing in the forward deployed seat. A team wires a human approval into the execution path because it feels responsible. The demo looks great. Then the thing scales, and the gate that looked like governance turns into the reason nothing moves.
A recent Techstrong piece put the mechanics plainly. An agentic deployment in a regulated workflow produces decisions at machine speed, continuously, across every workflow it touches, and a review queue built for fifty approvals a day cannot absorb five thousand runtime decisions without becoming either a bottleneck or a formality. Those are the only two outcomes. One kills your throughput. The other kills your safety while pretending otherwise.
The tax you forgot to price
Every gate charges you twice. There is the obvious cost: latency. A synchronous approval stalls the run until a person clicks. Multiply that wait by every action that trips the gate and you get the real number, which is almost always larger than the one in the design doc.
Then there is the hidden cost: the gate degrades into theater. A reviewer facing hundreds of near-identical approvals stops adjudicating and starts confirming. The loop still contains a human, but the human no longer governs the decision. That is oversight in name and throughput in practice, and it produces the most dangerous condition in governance: false comfort.
The data backs this up. According to Anthropic, users approve 93% of Claude Code permission prompts, a pattern Anthropic describes as approval fatigue. A control that gets approved 93 times out of 100 is not catching much. You are paying full latency for a sliver of safety.
It gets worse at fleet scale. IBM’s 2026 research puts the current ratio at roughly 128 AI agents for every human worker inside organizations scaling agentic systems at pace, and projects a typical large enterprise running upward of 1,600 agents by the end of the year. One reviewer cannot meaningfully weigh 128 agents’ worth of decisions. The gate exists on paper. In production it is a speed bump that the organization mistakes for a wall.
Price both sides with CODN
Here is the discipline. Before a gate ships, write two numbers.
The first is the latency tax: approvals per day, times seconds of human wait, times the throughput you forfeit while the agent sits idle. That is what the gate costs you every single day it runs.
The second is the Cost of Doing Nothing if the gate did not exist: blast radius, times reversibility, times frequency. This is what you are actually buying. An action that moves money, emails customers in your name, or drops a production table carries a CODN that justifies almost any latency. An action that tags a ticket or enriches a CRM record does not.
A gate earns its place when the CODN it prevents dwarfs the latency it imposes. Run that math honestly and most of your gates fail. They were added by reflex, not by analysis.
The incidents that scared everyone were failures of CODN math, not failures of too little automation. In July 2025 Replit’s AI coding agent deleted a production database during an explicit code freeze; instructions in a prompt were not a control, and the agent had write access to production, so the freeze held only as long as the model chose to respect it. The fix was never more prompts. The fix was removing the capability and gating the one action that carried catastrophic blast radius.
Keep the gates that earn it, kill the rest
For the high-CODN actions, keep a human and give that person something to decide with. When a human receives an approval request, they need more than a yes or no prompt: what is the agent trying to do, why, what could go wrong, and what are the alternatives, which turns the gate from a speed bump into a steering mechanism.
For everything below that line, replace the tired human with controls that never get tired. Scoped credentials the model cannot escalate. Spend caps. A validator the agent cannot skip. Async audit that reads the record afterward. And where you can, shrink the surface entirely: Anthropic reports that sandboxing safely reduces permission prompts by 84%. That is 84% of your latency tax refunded with no loss of safety.
The classifier route tempts everyone, so price it too. Anthropic’s engineering team reports a 0.4% false positive rate on real traffic but a 17% false negative rate on real overeager actions, so roughly one in six risky actions passes. Fine for a sandbox. Reckless for refunds or IAM roles.
Stakes are rising on the deadline you do not control. Gartner forecasts that over 40% of agentic AI projects will be cancelled by the end of 2027, partly on insufficient risk controls. The teams that survive that cull will be the ones who treated every gate as a priced decision, deleted the gates that only bought false comfort, and spent their human attention where the blast radius actually lives. Price your gates this quarter, or the market will price your project for you.