Human in the Loop AI Approvals: What to Gate and What to Let Run

Your AI receptionist books an appointment at 11 p.m. and nobody is woken up. That is fine. The same system offering to send 400 recall texts to lapsed patients is not fine, and the difference has nothing to do with how clever the software is. It is what happens when it gets one wrong.

Most practices set this up backwards. They either let the agent do everything, or they make a human approve everything, and both versions fail within a month. Deloitte's State of AI in the Enterprise survey of 3,235 business and IT leaders across 24 countries found 74% expect to be using AI agents at least moderately within two years, while only 21% report a mature governance model for them. That is enterprise data, not clinic data, but the gap it describes is exactly the one sitting in your front office.

This post gives you a rule you can apply in an afternoon, four tiers to sort actions into, a worked table of common front-office jobs, the on-leave problem nobody plans for, and the specific evidence that earns an action more freedom.

Gate on reversibility and blast radius, not on how clever the agent is

Two questions decide every action, and neither of them is about the model. Can you undo it, and how many people does one mistake reach? An action that is reversible and touches one patient can run unattended. An action that cannot be recalled and lands on hundreds needs a human.

Same agent, same day, opposite tiers. Reversibility and reach decide, not capability.

Booking one appointment is the easy case. If the agent puts a patient in the wrong slot, one phone call moves it. The blast radius is 1 patient, and the cost of the mistake is roughly 2 minutes of somebody's time.

Sending 400 recall texts is a different animal. Once the carrier accepts them there is no recall button. If the consent behind that list does not cover the message, TCPA statutory damages run at $500 per message, up to $1,500 where a court finds the violation willful or knowing, with no cap and each message counted separately. On a 400-person list that models to $200,000, or $600,000 at the willful rate. Those two figures are arithmetic on published statutory rates, not observed awards, but the arithmetic is the point: nobody should be able to trigger that by clicking through a prompt at 4:55 p.m.

The exemption people reach for does not cover it. The FCC's 2015 healthcare exemption covers appointment reminders, prescription notifications, lab result notifications, post-discharge follow-up and billing notices, and caps them at 1 message per day and 3 per week per healthcare matter. Recall and reactivation campaigns read as marketing, and marketing gets no exemption even from a licensed provider.

The four tiers, from run freely to never automate

Sort every action into one of four tiers. Run freely means the agent acts and nobody is interrupted. Run then notify means it acts and leaves a record a human reads later. Propose and wait means it drafts and stops. Never automate means a person does the whole thing.

Four tiers, not an on/off switch. The middle two keep the gate meaningful.

Run freely is for reversible actions with a blast radius of one: answering a question about opening hours, booking into an open slot, adding a caller to the waitlist. These still get logged. Logging is not oversight, but it is what makes the next tier decision possible.

Run then notify covers actions that cannot be pulled back but only reach one person. A single appointment reminder is the clean example. The text is gone the moment it sends, so there is nothing to approve in real time, but somebody should see the record before the pattern goes wrong 200 times.

Propose and wait is where the agent does the work and a named human presses go. Bulk sends, anything that moves money, anything that releases patient records. Never automate is the short list where no amount of accuracy changes the answer.

A worked tier for every common front-office action

Most front-office work sorts cleanly once you ask the two questions in order. Reads and single reversible writes run freely. Single outbound messages run then notify. Anything that leaves the building at scale, moves money, or releases records waits for a person. Clinical judgment never automates at all.

Three rows in that table are worth arguing about. Cancelling is not the inverse of booking, because the slot can be gone by the time anyone notices. A price quote is irreversible for a reason that has nothing to do with software: you said the number, and the patient heard it. A records release is a disclosure, and disclosures do not come back.

If you are still deciding which jobs to hand over at all, the sequencing question comes before the tiering question, and we work through it in what to automate first.

Who holds each approval, and what happens when they are on leave

Name a person and a named backup for every tier that requires one, then write the escalation into the system rather than the policy binder. An approval queue nobody empties is not caution, it is an outage: the patient who asked for a Tuesday slot on Friday never hears back.

Published clocks that keep running while an approval sits unopened. Verify each before repeating.

Time-box every approval. Strata's 2026 guidance suggests short lanes by risk, roughly 15 seconds for low-risk actions, 2 minutes for access to personal data, and 15 minutes for a financial disbursement, and it fails safe to denied when the clock runs out. Pickaxe's guide recommends a deadline near 30 minutes before an approval escalates or cancels safely. Both are vendor recommendations rather than research, so treat them as starting points and tune against your own front desk.

Expiry has to have a defined behavior. Escalate to the backup, or cancel and tell the patient. Silence is not a behavior, and it is what most configurations quietly default to.

Plan for the seat turning over, too. MGMA's 26-May-2026 Stat poll of 303 practice leaders found 28% reported higher staff turnover than 2025, with front-desk and entry-level administrative roles among the most common churn points. If your approval routing points at a person rather than a role, it breaks the week they leave.

Approval fatigue, and why gating everything is worse than gating nothing

Gate too much and your staff stop reading. Healthcare has already run this experiment with clinical alerts, and the result is well documented: in one emergency department study, physicians overrode 92.9% of medication alerts, while only 7.3% of those alerts were judged clinically relevant. Sheer volume trained the habit.

That study covered 382 alerts at a single academic center between August 2019 and June 2020, so it is one data point rather than a universal rate. It is still the right warning. Nothing about a front-office approval queue is more interesting than a drug interaction warning, so if clinicians learned to dismiss those, your office manager will learn to clear yours.

Governance writing outside healthcare lands in the same place. Arthur's guidance is blunt about it: rubber-stamping is worse than no gate at all, because it creates the appearance of oversight without the substance. And if a gate fires so often that reviewers stop reading it, the threshold is wrong, not the reviewer. Strata calls the same failure automation complacency, where a system that looks reliable makes its overseers less vigilant, not more.

A workable budget, and this one is a rule of thumb rather than a finding: if one person is clearing more than 10 approvals a day for the same routine action and changing almost none of them, that action is in the wrong tier. Count the approvals for a week before you argue about it.

Loosen a tier only when the evidence says so, and name the evidence

Tiers should move, but only on evidence you defined before you started. Set the bar in writing: a minimum count of reviewed actions, a correction rate under a stated threshold, a clean incident record over a fixed window, and a rollback you have actually used once on purpose.

Concretely, four things earn an action a looser tier. At least 50 real examples reviewed by a human, not a demo run. A correction rate under about 5%, which is the cut-off commonly cited for graduating an action from waiting on a person to merely being watched by one. No patient-facing incident traced to that action over 30 to 60 days. And a rollback you have deliberately exercised, so you know it works before you need it.

Move one tier at a time. Propose and wait becomes run then notify, never straight to run freely. Skipping the middle tier means you lose the record that would have told you the loosening was a mistake.

Tiers tighten as well. One real incident moves an action back a step, and that should be automatic rather than a debate. A tier list that only ever loosens is not a policy, it is a ratchet.

Field note

Before you loosen a tier

• Someone has read at least 50 real examples of that action, not a demo run.
• The correction rate on those examples sits under 5%, and you can show the count.
• No patient-facing incident traces back to that action over the last 30 to 60 days.
• A named person still owns the tier after the change, and the rollback has been tested.

Write the tiers down before you switch anything on

Put the tier list on one page, with the action, its tier, the named approver, the backup, and what happens when an approval expires. Then walk each new action through the same two questions before it goes live, instead of arguing about it after a patient has already been messaged.

Two questions, asked in order. Every action leaves with a tier and a named owner.

Walk the flow once. Clinical judgment leaves the flow immediately and goes to a licensed human. Anything you can undo in minutes runs freely and gets logged. Anything you cannot undo splits on reach: one patient means the agent acts and a human reads the record, many patients means the agent drafts and waits. That is the whole rule, and it fits on an index card.

One more thing worth putting on the same page: which vendor is a business associate and whether the Business Associate Agreement is signed. HIPAA compliance is a configuration and a contract, not a badge, and "HIPAA certified" is not a real thing. The clocks are unforgiving if you get it wrong, with individual breach notice due within 60 days of discovery and a breach touching 500 or more people pulling in media notice and the HHS Secretary.

If you would rather see where your front office is actually losing patients before you tier anything, the free Growth Leak Audit sizes it from your own numbers.