P5: Protecting HITL & Preventing Decision Fatigue Exploits

Score each pending agent action by risk and use that score to rank the HITL review queue so reviewers tackle the highest-impact decisions first.

Automate routine low-risk approvals and escalate only high-impact decisions to a human reviewer.

Cap the volume of AI-generated notifications per reviewer per hour to prevent cognitive overload.

Enforce rate limits on agent-generated notifications, approval requests, and alerts to block decision-fatigue-as-an-attack-vector.

Require two-agent consensus before any agent is permitted to modify its own operational goals.

Surface a plain-language explanation of each pending decision alongside the agent's recommendation so reviewers can act without re-reading raw logs.

Distribute the review queue across available human reviewers so no single operator is presented with an unmanageable volume.

Strip or sandbox all clickable links and rich content in agent output so social-engineering payloads cannot complete a click-through to the attacker.

Provide a documented, tested kill-switch covering single-agent, fleet, and global scopes with a named authority and drill cadence.

For irreversible high-stakes changes such as payments or production configuration writes, require confirmation through a channel independent of the agent.

For irreversible high-impact actions, require two distinct human reviewers to independently approve and sign off before the agent proceeds.

Validate each pending agent plan against its declared goal before approving execution to detect and block unintended behavioural shifts.

Monitor how frequently each agent requests goal changes and alert when the rate suggests active manipulation rather than legitimate adaptation.

Scan agent outputs and tool-call parameters for PII, secrets, and sensitive IP before egress so phishing payloads cannot reach the end user.

Write every HITL decision and agent recommendation to a cryptographically signed, append-only log to prevent post-hoc tampering.

Run real-time anomaly detection across the agent decision stream and escalate sessions that deviate from expected patterns.

Log every human override of an agent recommendation and surface reviewer-pattern analytics to detect bias or systematic misalignment.

Flag decision reversals in high-risk workflows where a previously rejected AI output was later approved under suspicious conditions.