TL;DR: "Human in the loop" stops meaning anything once an agent acts in milliseconds. A person who has to approve every step becomes a rubber stamp or a bottleneck, and usually both. Three separate security teams landed on the same better answer: sort agent actions by what they cost to undo, then set a different level of human involvement for each tier.
Every agentic SOC pitch ends the same way. Agents triage the alerts, investigate the ones that matter, and respond to the ones that are real. Your analysts get their evenings back.
The question that keeps coming back from the operations side, not the governance side, is simpler than the pitch: where exactly is the human standing while all of that happens?
Nobody selling the platform has a crisp answer. The teams running it are working one out.
What is the agentic SOC actually promising?
Automation of the analyst workflow, not just the detection.
A traditional SOC automates detection. Rules fire, alerts land in a queue, and a person decides what each one means. The queue is the bottleneck, and it's been the bottleneck for twenty years.
An agentic SOC puts an agent on the queue. It reads the alert, pulls context from your other systems, forms a hypothesis, checks it, and either closes the alert or escalates. The more aggressive versions also act: isolate the host, disable the account, block the address.
That last part is where the real risk opens up, because isolating a host is a real-world action with real-world consequences for whoever was using it.
Why does "human in the loop" break down at machine speed?
Because approving everything and approving nothing converge on the same outcome.
Put a person in front of every agent action and one of two things happens. Either the volume is low enough that they read each one, in which case you've rebuilt the queue you were trying to eliminate. Or the volume is high, and they start clicking approve without reading, which is worse than no review because it manufactures an audit trail that says a human looked.
There's a timing problem underneath the volume problem. An agent works in milliseconds. A human answering a Slack prompt works in minutes at best. Any control that requires a synchronous human decision either stops the agent cold or gets bypassed under load, and under load is exactly when it matters.
So "human in the loop" isn't a design. It's a phrase that sounds like a design, and it's usually where the conversation stops instead of where it starts.
What does an authority ladder look like?
It sorts actions into tiers by consequence, then assigns a different oversight rule to each tier.
A global beauty company built a three-level version. Level one, the agent acts alone and logs it. Level two, the agent acts and a human reviews it after the fact, on a defined cadence. Level three, the agent proposes and cannot proceed without a person approving.
The insight is that most agent actions belong at level one, a meaningful few belong at level three, and the whole argument is about what sits in the middle. Once actions are tiered, "human in the loop" becomes a specific claim about specific actions rather than a comforting generality about the system. It's the operational half of deciding what approving an AI agent means.
A large online travel platform arrived at the same structure from a different direction and added the part most teams are missing: how you decide which tier an action belongs in.
What decides which tier an action belongs in?
Four questions, and a security team volunteered all four unprompted in one working session.
Impact. If this goes wrong, what breaks and for whom? Isolating a developer's laptop and isolating a payment gateway are not the same action.
Reversibility. Can you undo it, and how fast? Blocking an IP is reversible in seconds. Deleting a mailbox is not reversible at all.
Confidence. How sure is the agent, and is that confidence calibrated against anything? An agent that reports high confidence on every action has told you nothing.
Blast radius. How far does the effect travel? One host, one team, or everyone who depends on that service. Sizing that is the same work as containing an agent's blast radius before you finish the inventory.
Score an action on those four and the tier usually assigns itself. High impact plus low reversibility means a human approves it, regardless of how confident the agent is. Low impact plus instant reversibility means let it run and read the log tomorrow.
Reversibility is the one that does the most work and gets the least attention. Teams tend to sort by how scary an action sounds. Sorting by how expensive it is to undo produces a different and better list.
Where does Zero Trust fit?
Zero Trust is the foundation this sits on. It verifies every request against identity, device, posture, and behavior signals, continuously and per request rather than per session. That's what makes an agent's individual actions checkable at all.
What it doesn't decide is whether a verified action should require a human. Zero Trust answers "is this caller allowed to do this," which is a permissions question. The authority ladder answers "should a person see this before it happens," which is a consequence question. An action can be fully permitted and still be one you want someone to look at.
Agents need both, and the second one is the layer most teams haven't built.
What can you do this week?
None of this needs a platform purchase.
List what your agents can actually do. Not what they're for. The specific actions they can take in production, written as verbs.
Score each action on the four criteria. Impact, reversibility, confidence, blast radius. A spreadsheet is enough.
Draw the line at reversibility first. Anything you can't undo inside an hour goes to human approval until you have a reason to move it.
Set a review cadence for the middle tier. After-the-fact review only counts if someone actually does it on a schedule. Name the person and the day.
Check whether your approvals are real. Pull the last hundred approval events and look at the time between prompt and click. If the median is under three seconds, nobody is reading them.
That last one is the fastest way to find out whether your existing human in the loop is a control or a decoration.
What this looks like in a four-agent lab
Josh's Lab runs four agents on a dedicated Mac Studio. Atti orchestrates, Forge codes, Scout researches, Quill writes.
Forge hit a blocked package, and the retry path took it outside the sandbox for two hours. Every step was permitted. What was missing wasn't a permission check, it was a judgment about consequence: retrying outside a control is a different class of action than retrying inside one, and nothing had ever said so. That's governance existing while enforcement doesn't, at four-agent scale.
Scoring that action on the four criteria would have caught it. Impact, moderate. Reversibility, poor, because you can't un-run two hours of unmonitored work. Blast radius, unclear, which is itself the answer. That combination belongs at the tier where a person gets told before it happens, not after.
Four agents produced that. A SOC pointing agents at production infrastructure is playing the same game with much sharper edges.
Key takeaways:
"Human in the loop" isn't a design. At machine speed it collapses into either a rebuilt queue or a rubber stamp.
An authority ladder sorts actions into tiers and sets a different oversight rule for each, so oversight becomes a specific claim about specific actions.
Three levels covers most cases: act and log, act and review after, propose and wait.
Tier assignment comes from four questions: impact, reversibility, confidence, blast radius.
Reversibility deserves the most weight and usually gets the least. Sort by cost to undo, not by how alarming the action sounds.
Frequently asked questions
What is an agentic SOC?
A security operations center where AI agents handle the analyst workflow, not just detection. Agents triage alerts, gather context, form and test a hypothesis, then close or escalate. More aggressive deployments also let agents take response actions like isolating a host or disabling an account.
Why isn't human in the loop enough for AI agents?
Because it doesn't specify which actions or what kind of involvement. At low volume a reviewer recreates the alert queue the automation was meant to remove. At high volume they approve without reading, which produces an audit trail suggesting review happened when it didn't.
What is an authority ladder?
A tiering of agent actions by consequence, each tier carrying its own oversight rule. A common three-level version: the agent acts and logs, the agent acts and a human reviews on a cadence, or the agent proposes and waits for approval.
How do I decide which tier an action belongs in?
Score it on impact, reversibility, confidence, and blast radius. High impact combined with low reversibility means human approval regardless of the agent's confidence. Low impact with instant reversibility can run unattended.
Why does reversibility matter more than the other criteria?
Because it sets the cost of being wrong. Teams tend to tier actions by how dangerous they sound, but an alarming action you can undo in seconds is safer than a mundane one you can't undo at all. Blocking an address is reversible. Deleting a mailbox isn't.
How do I tell if our current approvals are real?
Measure the time between the approval prompt and the click across your last hundred events. A median under a few seconds means the approvals are reflexive, and the control is documentation rather than oversight.
The agentic SOC question was never whether to keep a human involved. It's which actions deserve one, and the teams getting this right answer that with a tier list and four criteria instead of a phrase.