AID-M-006: Human-in-the-Loop Control Design & Readiness
Design and validate the human-control system for AI actions that require review, override, escalation, or emergency intervention. Define each checkpoint and timeout path, qualify the assigned operators on the exact interface and procedure, exercise the complete branch population, and maintain a canonical audit-event contract that lets an independent verifier reconcile activation through final action.
Scope boundary
Owns Human-in-the-Loop checkpoint design, operator qualification and readiness, escalation topology, and audit-event contracts. It prepares and verifies the human-control system but does not make runtime authorization decisions or execute incident containment.
AID-H-018: AID-M-006 designs and tests the human-control architecture and evidence contract; AID-H-018 enforces runtime tool authorization, approval, and execution-time verification. Readiness evidence does not unlock an action, and a runtime gate does not replace checkpoint design or operator qualification.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0048 External Harms
- AML.T0053 AI Agent Tool Invocation
- AML.T0101 Data Destruction via AI Agent Tool Invocation
MAESTRO
- Poisoning Observability Data (L5)
- Repudiation (L7)
OWASP LLM Top 10 2026
- LLM03:2026 Excessive Agency
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI08:2026 Cascading Failures
- ASI09:2026 Human-Agent Trust Exploitation
NIST Adversarial Machine Learning 2025
- NISTAML.027 Misaligned Outputs
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-2.1 Excessive Agency
- AISubtech-2.1.1 Execution Approval Bypass
Google Secure AI Framework 2.0 - Risks
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model Management 8.3: Model lifecycle without HITL (human-in-the-loop)
- Model Serving - Inference requests 9.13: Excessive agency
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.8: Repudiation & Untraceability
- Agents - Core 13.10: Overwhelming Human in the Loop
- Agents - Core 13.15: Human Manipulation