Constrain, Escalate, Contain
The alternative to "human in the loop". Three layers that assume the fallible component fails — because after two decades of research, we know that "the fallible component" is the human.
73% → 62% — clinician diagnostic accuracy under biased AI assistance (JAMA 2023, n=457). The reason HITL is not the answer.
The definition
Constrain, Escalate, Contain is what you build when you have taken the human-factors research seriously and stopped pretending "human in the loop" is a control. Three layers, each with a specific job:
Constrain by default
Decide what the agent cannot do before it runs. Least-privilege credentials, scoped access, policy checks that block prohibited actions at pre-check and at runtime. Most important for irreversible operations: deleting data, exfiltrating it, lateral access to crown jewels.
Escalate by exception
Save human approval for the rare, consequential, hard-to-undo decisions — and give the person real context and real authority to say no. A reviewer who sees three meaningful decisions a week is a judge. A reviewer who sees three hundred is a clicker.
Contain on failure
Something will get through. Detection that flags abnormal behaviour, circuit breakers that halt on defined conditions, kill switches that revoke credentials in seconds. Fast reaction to a rare alarm is the one job humans are actually built for.
Why it costs money (and why HITL costs more)
Naive HITL looks free — you already pay the reviewer's salary. What it actually costs is invisible until an incident: the false sense of control, the compliance signature that does not correspond to review, and the crumple-zone dynamic where the reviewer absorbs the blame for a system failure. The underlying essay walks the research: JAMA (2023) shows clinician accuracy dropping from 73% to 62% under biased AI assistance; the CHI 2025 study on knowledge workers shows critical thinking declining as AI trust rises; JMIS (2016) shows warning habituation degrading with each additional approval prompt.
Constrain, Escalate, Contain has a real budget line — scoped credentials, runtime policy, behavioural monitoring, kill switches, audit — but it is a budget line, not slideware. The DroidWork model prices it in the Security & compliance dimension. It is the difference between a governance claim and a governance implementation.
The pattern in one sentence
Use people where judgement is scarce and the stakes are high. Use infrastructure where enforcement has to be constant, fast and complete. Build it so neither one has to be perfect.
Where each layer lives in your stack
- Constrain — IAM, scoped tokens, tool allowlists, request-time policy engines (OPA, Cedar), network segmentation.
- Escalate — approval routing that fires only on defined risk conditions; escalation queues that batch peers together for context.
- Contain — anomaly detection on agent behaviour, circuit breakers on rate/scope/action, kill switch bound to credential revocation.
None of these are novel primitives. What is novel is the discipline of using them instead of — not in addition to — a human-in-the-loop signature line.
Model this on your deployment
This framework is baked into the DroidWork TCO calculator. Adjust the inputs — the numbers move accordingly.
Open the Calculator →Frequently asked
What is Constrain, Escalate, Contain?
A three-layer safety pattern for AI agents: constrain what the agent can do by default with least-privilege runtime controls, escalate only rare and consequential decisions to a human with real authority, and contain failures with detection, circuit breakers and kill switches. It is the alternative to relying on human-in-the-loop approval as a safeguard.
Why is Constrain, Escalate, Contain preferred over human-in-the-loop?
Because two decades of human-factors research show that humans reviewing a system that is right most of the time habituate to the "approve" button. A JAMA 2023 study showed clinician accuracy dropped from 73% to 62% under biased AI assistance. Constrain, Escalate, Contain assumes the fallible component (the human) fails and designs around it.
What is "constrain" in practice?
Least-privilege credentials, scoped tool access, and policy checks that block prohibited actions before and during agent execution. Implemented via IAM, request-time policy engines like OPA or Cedar, and network segmentation.
What is "contain" in practice?
Anomaly detection on agent behaviour, circuit breakers that halt execution on defined conditions, and a kill switch that revokes credentials in seconds. This is where humans genuinely add value — reacting hard to a rare alarm.
See also
This framework is documented as part of the open-source DroidWork AI TCO Framework. Cite it as: DroidWork.ai (2026). "Constrain, Escalate, Contain." https://droidwork.ai/frameworks/constrain-escalate-contain/