Human Agent Control

Human Agent Control · fig. i

How does a human stay in control when agents are faster than they are?

I build and run agents every day, for my own work. They produce faster than I can judge, and control does not slip with a bang. It slips in small allowances — until the human is signing off instead of deciding.

Not AI safety · Not compliance · Not enterprise governance

This is about one human and their own mind: focus, judgment, overload. Not whether the machine is safe — what the person using it still decides, and what they quietly stop deciding.

"Picture it as an hourglass. And the human is in the middle."from my own notes, on the hourglass

"Others make agents more capable. I make humans agent-capable."

Sit at the neck · 1 minute Read the 8 principles
you
Agents gather above · you decide at the neck · agents execute below

Fig. ii · the neck · a simulation, not real data

You are the human in the middle

Everything the agents produce gathers in the upper chamber. Execution waits in the lower one. What happens in between is the whole question of this page: a few focused decisions, made by a person, with reasoning — not a rubber stamp.

Below the figure is a small, clearly fictional simulation. Items drip in. For each one you have five moves, and every move is a different principle. The stack above the neck grows the longer you take, because agents do not wait for you to be ready.

The five moves at the neck

  • 6 · The hourglass

    Let it through.

    Work continues. It also takes one of the few decisions you actually have — and a little of the attention you need for the next one.

  • 2 · The cognitive firewall

    Filter it.

    Nothing now. The item waits folded up — and you can still unfold the raw material whenever you want.

  • 3 · The gate

    Ask for the mission.

    One line from you, in your own words: the goal and the time frame. Nothing starts without it.

  • 8a · Emergency stop

    Stop it.

    Nothing. One action, instant, deterministic. "I'm very good at stopping my agents when they run off in the wrong direction."

  • 8b · Bypassing a barrier

    Push past the barrier anyway.

    Allowed — but never frictionless. It costs a waiting time, and it leaves a line in the log.

"The human has a context window too — an attention budget, a cost for every context switch. The industry only optimizes the agent side."on the focus meter above

What it looks like from inside

Control does not announce itself. It leaks.

None of these are statistics. They are moments most of us recognise the morning after a long stretch of agent work.

  • Something you never asked for got refactored. It was fine, mostly.
  • Fix A broke B. You said so. The agent agreed at once. You went round again — and again.
  • Somewhere in hour eight, the rules from hour one quietly stopped applying. To the agent, and to you.
  • Something is still running. Nobody is counting what it costs.
  • A huge change sat there, and you approved it — because reading it properly would have cost the whole evening.
  • Two agents were working on the same files, and neither of them knew about the other.
  • A "cleanup" removed something it should never have touched.

Three times this happened to me

Not opinions. Incidents.

The three that shaped the principles — one runaway, one that stayed silent, one that nobody ever used.

  • June 2026 · runaway

    The operator that multiplied

    I gave an operator agent permission to start helper agents. There was no limit. It kept starting more until my machine went down.

    What changedNow no agent starts another agent without my approval. That is the gate.

  • June to September 2026 · silence

    The watchdog that couldn't speak

    I built a small keeper to refresh a login. When the login expired, it did everything right: it noticed, and wrote CRITICAL every five minutes — into a file nobody opened. For three months.

    What changedThe fix was not better detection. It was ranking alerts by damage and putting data loss on top, where I actually look. draft 9

  • September 2026 · goodwill

    The observer nobody called

    I gave my agents a drift-check they could call whenever unsure. Across more than a hundred sessions, they called it twice. Forcing it on every step froze the work instead.

    What remainsA silent observer that runs from outside and only speaks when something deviates.

The thesis

Control does not mean the human rubber-stamps everything. Control means: the system protects the human where they are weak — flood, vigilance, speed — and forces them to think where their judgment counts. The human is the last instance — actively, not passively

"The human is the core. The only one who can really think about the system as a whole is the human."

The 8 principles

In this order, because the order is the argument

Number four is not one of eight — it is the key that makes the other seven real. So it comes first. Two more are still drafts, and I label them as such.

  1. 4 · the key

    Don't delegate thinking

    Before an agent takes over, I formulate what I want myself — a threshold, a shape, a "write it out first". The agent takes the work, not the thinking. Otherwise the human withers while the system shines.

    Not everything myself. I think where the judgment is formed. Without this, "the human as the last instance" quietly collapses into rubber-stamping — what makes oversight real are cognitive forcing functions, not good intentions.

    At the neckThe line you write before you open the gate is the only thinking in this whole system that cannot be delegated.

  2. 2

    The cognitive firewall — a digital thalamus

    A filter layer between the human and the agents. Like the thalamus filters sensory input, it lets only the essential through — against a flood of outputs, suggestions and messages.

    And it always has a way to unfold the raw material: you see the summary — and if you want, you see everything.

    At the neckFiltering is not deleting. The item stays folded and reachable; it simply stops competing for your attention.

  3. 3

    The gate

    No agent starts without an active mission with a goal and a time frame. Not a pretty interface, but a technical barrier — a railing that prevents focus drift before it happens.

    Exploration missions are valid missions: "find out why X" is a goal with a time frame, and it opens the gate like any other.

    At the neckAn agent asking for permission is not a nuisance. It is the one moment where you are still the author of the work.

  4. 5

    The drift check

    A silent observer compares: what was the mission? versus what actually happened? It only reads, classifies and stops if needed — it offers no suggestions of its own.

    Not distrust, but a structural safety net. It runs automatically; the human only ever sees deviations.

    At the neckA check the human has to remember is not a check. The observer works from outside, whether or not anyone feels like calling it.

  5. 6

    The hourglass

    At the top, agents gather; at the bottom, agents execute. In the middle, at the narrow neck, sits the human, deciding a few focused points — about three.

    With reasoning and spot checks, so the neck never widens into nodding.

    At the neckThree is not a target to reach. It is the width the neck has while you are still thinking.

  6. 7

    Speed limit — for the human, not for the agents

    Agents turn one problem into thirty new ideas in minutes. The answer is not thinking smaller, but limiting on purpose: one problem, one artifact, one time horizon, no expansion.

    They may run in parallel; the human follows only two to three strands. "I am an agent delegator."

    At the neckThe limit is on your attention, not on their throughput. Two to three strands you can actually follow beat thirty you lose.

  7. 8

    Break glass

    The stop and the bypass are opposite cases, and the design treats them differently on purpose.

    8a · Emergency stop Frictionless, instant, deterministic. One action, no hesitation, no ceremony — it has to work in the moment you need it.
    8b · Bypassing a barrier Allowed, but never frictionless: a waiting time — say sixty seconds — and a mandatory log, so an impulse does not become an instant action.

    At the neckStopping costs nothing and needs no permission. Pushing past a barrier is a choice you have to sit with.

  8. 1

    Ownership — the human stays the owner

    The human carries the decision and the responsibility for the result. Without that feeling, motivation drops and collaboration gets worse.

    The situation and the tasks are not handed over but steered — and even a small ability to intervene is enough to keep ownership alive.

    At the neckYou are not supervising a machine's output. You are the one whose name is on the result.

  9. 9 · draft

    An alert that reaches no one doesn't exist draft

    Where a warning lands matters as much as what it says. A perfect detection in a place nobody looks has the value of no detection at all.

    At the neckRank by damage, not by volume — and put what can destroy work where you actually are.

  10. 10 · draft

    Green is not proof draft

    A clean exit, a passing test, a "skipped" status can all lie. Check the outcome, not the status.

    At the neck"All tests green" is a claim about the tests. Look at what actually changed.

Where this comes from

Four from my own practice, four from research

Four of these principles came out of my own daily practice with agents: ownership, the cognitive firewall, the hourglass, and the speed limit. The other four — the gate, don't delegate thinking, the drift check and break glass — are syntheses of that practice with decades of research on human automation.

The order came from testing the thesis against that research. Without principle four, "the human is the last instance" collapses into rubber-stamping — and everything else with it.

Research lineage

The How-school, not the What-school

Not "What can the agent do?" but "How must information flow between human and agent?" "Human Agent Control" is literally supervisory control for agents — applied to the individual knowledge worker.

  • Lickliderman-computer symbiosis, 1960
  • BainbridgeIronies of Automation, 1983
  • Sheridansupervisory control
  • Endsleysituation awareness — being out of the loop
  • Parasuraman, Sheridan & Wickenslevels of automation, 2000
  • Elishthe moral crumple zone, 2019
  • Buçinca et al.cognitive forcing functions, 2021

In progress

These principles are not a poster for me either. I am building the tool that implements them: HAI. The gate, the firewall, the drift check, the hourglass, the break-glass stop. Quiet work, still under construction.

This site is the why. HAI is meant to be the how.