A human in the loop is not a disclaimer at the bottom of a screen. It is a named role, at a named step, with the authority they already have. The assistant prepares. The person who owns that decision releases it.
Different steps, different people
A sales lead can release a quote. A production supervisor accepts a schedule change. A maintenance planner releases a work order. A quality engineer decides whether a lot ships. The engineering change board decides a revision, the way it does today. One person signing "approved" at the end does not cover those decisions. Each of them can be wrong in a different way, and each of them is already someone's job.
What needs a person
- Anything that writes, sends, or deletes a record.
- Anything that spends money, moves material, or changes a schedule inside the window you have frozen.
- Any claim about what failed, when the record is thin. The assistant stops. It does not guess the part.
What does not
Looking something up is not a change. A person should not have to approve a search of the service history, a citation from the manual, or a trend from the historian. If every read needs a signature, the loop becomes a queue and people start clicking through it. Put the person where the system of record would change, and where a wrong judgment is expensive.
How you know the loop is real
The record of the case should show who asked, what was looked up, what was proposed, who approved it, and what happened. If the approval can be skipped, or if the same person approves their own request with one click and no pause, you have a button, not a control. Asking twice must not create two changes.
Design the loop from the jobs you already run. Write down who releases a quote, a schedule, a work order, and a nonconformance today. Give the assistant the draft. Leave the release where it is. Add a person only where a miss would be hard to undo. That is how you get accuracy without hiring a second shift to watch the first one.