Scope boundary

Owns machine-readable checkpoint requirements, trigger conditions, protected action classes, reviewer roles, required evidence, timeout and escalation requirements, pause and resume interface specifications, and operator procedures.

AID-M-006.003: AID-M-006.001 specifies when a checkpoint exists and what its operator must review; AID-M-006.003 specifies runtime escalation routing, deadlines, event fields, producer obligations, and lifecycle reconciliation. Checkpoint design does not prove that escalation delivery and audit-chain closure work at runtime.

AID-H-018.003: AID-M-006.001 defines the high-impact review checkpoint and its human procedure; AID-H-018.003 independently validates the exact action and produces the runtime approval or denial receipt. A design artifact cannot authorize execution, and the runtime gate must implement rather than redefine the approved checkpoint contract.

Implementation guidance

• AID-M-006.001-G001: Define and version HITL checkpoints as required SDLC configuration artifacts.
• AID-M-006.001-G002: Create clear SOPs for every HITL checkpoint and link them directly from alerts.

AID-M-006.001-G001

Concept:

Treat each HITL checkpoint as a typed design-time contract, not a free-text trigger. Bind it to the exact AI system scope, release, signed policy, protected action, current escalation topology, and pause/resume interface that runtime enforcement will implement.

Define and validate the checkpoint contract

# File: design/hitl-checkpoint.schema.yaml
$schema: https://json-schema.org/draft/2020-12/schema
type: object
additionalProperties: false
required: [schema_version, checkpoint_id, scenario_id, release_digest, policy, trigger, protected_action, review_evidence, operator_roles, deadlines, default_action_on_timeout, escalation_topology, dual_control, interfaces]
properties:
  schema_version: {const: aidefend.hitl_checkpoint.v1}
  checkpoint_id: {type: string, minLength: 1}
  scenario_id: {type: string, minLength: 1}
  release_digest: {type: string, pattern: '^sha256:[0-9a-f]{64}$'}
  policy:
    type: object
    additionalProperties: false
    required: [id, version, digest]
    properties:
      id: {type: string, minLength: 1}
      version: {type: string, minLength: 1}
      digest: {type: string, pattern: '^sha256:[0-9a-f]{64}$'}
  trigger:
    type: object
    additionalProperties: false
    required: [grammar, expression]
    properties:
      grammar: {enum: [cel, rego, cue]}
      expression: {type: string, minLength: 1}
  protected_action:
    type: object
    additionalProperties: false
    required: [action_id, action_class, input_schema_digest]
    properties:
      action_id: {type: string, minLength: 1}
      action_class: {type: string, minLength: 1}
      input_schema_digest: {type: string, pattern: '^sha256:[0-9a-f]{64}$'}
  review_evidence: {type: array, minItems: 1, uniqueItems: true, items: {type: string, minLength: 1}}
  operator_roles: {type: array, minItems: 1, uniqueItems: true, items: {type: string, minLength: 1}}
  deadlines:
    type: object
    additionalProperties: false
    required: [acknowledge_seconds, decision_seconds, escalate_seconds]
    properties:
      acknowledge_seconds: {type: integer, minimum: 1}
      decision_seconds: {type: integer, minimum: 1}
      escalate_seconds: {type: integer, minimum: 1}
  default_action_on_timeout: {const: reject}
  escalation_topology:
    type: object
    additionalProperties: false
    required: [topology_id, version, digest, escalation_required]
    properties:
      topology_id: {type: string, minLength: 1}
      version: {type: string, minLength: 1}
      digest: {type: string, pattern: '^sha256:[0-9a-f]{64}$'}
      escalation_required: {const: true}
  dual_control: {type: boolean}
  interfaces:
    type: object
    additionalProperties: false
    required: [pause_command, resume_command, decision_receipt_schema_digest]
    properties:
      pause_command: {type: string, minLength: 1}
      resume_command: {type: string, minLength: 1}
      decision_receipt_schema_digest: {type: string, pattern: '^sha256:[0-9a-f]{64}$'}

check-jsonschema --schemafile design/hitl-checkpoint.schema.yaml design/hitl-checkpoints/*.yaml
# Also compile each trigger with the declared CEL, Rego, or CUE parser and reject unknown fields.

Validate that acknowledgement and escalation occur before the decision deadline and that dual-control checkpoints name at least two distinct eligible roles. Resolve all values from the same verified policy; example amounts or timeouts are not AIDEFEND defaults. During design review, reconcile every policy-classified high-impact action to exactly one current checkpoint contract and reject missing, extra, stale, sibling-release, or unparseable bindings.

Action: Version the schema and instances with the release. A design artifact proves the approved checkpoint contract only; the runtime gate in AID-H-018.003 still owns the allow or deny decision.

AID-M-006.001-G002

Concept:

Operators need concise, unambiguous playbooks under time pressure. SOPs must define steps, timeouts, dual-control (if any), and escalation.

SOP Template

# File: docs/sops/HITL-CP-001.md
# SOP: High-Value Financial Transaction Approval (HITL-CP-001)

## 1. Overview
- System: Payment Processing Bot
- Purpose: Manual approval for transactions over $10,000 USD

## 2. SLAs & Controls
- Acknowledge within: 60 seconds from checkpoint activation
- Decision deadline: 180 seconds from the same checkpoint activation (default = Reject)
- Dual control required: No

## 3. Procedure
1) Acknowledge alert in PagerDuty
2) Verify context (transaction_id, amount, recipient)
3) Decision: Approve or Reject

## 4. Expected System Responses
- Approval: "processed successfully"
- Rejection: "halted by operator"

## 5. Escalation
- If the alert is not acknowledged within 60 seconds, escalate to the L2 Analyst; escalation does not reset the original 180-second decision deadline

Policy note: The SOP values above illustrate structure only. Source the action amount, acknowledgement and decision deadlines, escalation path, operator role, and dual-control rule from the same signed, versioned organizational policy as the checkpoint; none is an AIDEFEND default.

Machine-check the ordered deadline and link binding

# Policy-rendered values; no AIDEFEND timing defaults.
acknowledge_seconds: 60
escalate_seconds: 60
decision_seconds: 180
alert_binding:
  checkpoint_id: HITL-CP-001
  checkpoint_version: 7
  policy_digest: sha256:<64-lowercase-hex>
  sop_digest: sha256:<64-lowercase-hex>

Admission must require positive integers with acknowledge_seconds <= escalate_seconds < decision_seconds. Resolve the alert URL server-side from the authenticated binding rather than trusting a caller-provided URL, and refuse decisions whose checkpoint instance, policy, SOP, role, or deadline differs from the active record.

Action: Validate the ordering and exact alert binding before publication, then store the SOP with code and include only the bound, short-lived link in alert payloads.

Before you begin

Apply this method when an AI workflow contains a policy-classified action or decision that requires human approval, review, or intervention.

Exercise the operator path

In staging, trigger each checkpoint and confirm that the alert links the exact checkpoint and SOP version. Submit unauthorized, expired, and no-response decisions, verify the default-deny result, then read back the recorded actor, time, checkpoint ID, decision, and escalation event from the audit path.

Open-source tools

• check-jsonschema
• Ajv
• CUE
• MkDocs
• Camunda Modeler

Commercial / hosted tools

• PagerDuty Operations Cloud
• ServiceNow IT Service Management
• Pega Platform

Threat mappings

MITRE ATLAS

• N/A

MAESTRO

• N/A

OWASP LLM Top 10 2026

• N/A

OWASP ML Top 10 2023

• N/A

OWASP Top 10 for Agentic Applications 2026

• N/A

NIST Adversarial Machine Learning 2025

• N/A

Cisco Integrated AI Security and Safety Framework

• AISubtech-2.1.1 Execution Approval Bypass (Tests rejection of unauthorized, expired and unanswered human-approval requests)
• AITech-2.1 Excessive Agency (Tests rejection of unauthorized, expired and unanswered human-approval requests)

Google Secure AI Framework 2.0 - Risks

• N/A

Databricks AI Security Framework 3.0

• N/A