human in the loop for anything that writes, always. read only agents i let run completely unsupervised and never think about them again

我的做法是按可逆性分级，而不是一刀切地都要人确认。能一键撤销的操作直接放开，让它自己跑，但必须写完整的审计日志，事后可以逐条追；不可逆的，比如付款、删除、对外发送，一律停下来等人。 这样分完之后你会发现真正需要人盯的动作比想象中少得多，剩下那些也确实值得停一下。一开始就要求每一步都确认，最后的结果往往是人麻木地一路点确认，那反而比不要确认更危险，因为责任转移了但审查没有真的发生。

THE APPROVAL STEP IS WHERE ALL THE VALUE LEAKS 😤 if a human has to read every row before it commits you did not automate the task you just moved it and added a waiting step 🔥

The middle ground that has worked for us is sampled review rather than full review. Check a random slice, track the error rate over time, and widen the automatic path as the rate holds. You get a number instead of a feeling, and the number is what eventually lets you stop checking.