Glossary · Verifiable AI

Human-off-the-Loop — HOTL

ヒューマン・オフ・ザ・ループ

An operating model where AI executes decisions without waiting for per-item human approval. A human monitors and intervenes as needed, but does not gate each decision. Throughput rises sharply — and the accountability the human eye used to provide must be filled by another mechanism.

Definition

Human-off-the-loop (HOTL) describes designs that commit AI decisions without human approval, with the human moved to exception monitoring and after-the-fact review. For agents executing payments, procurement, or data access continuously, throughput is unattainable without HOTL.

The problem is the accountability gap. A human not being in each decision means that unless 'who decided what, when, and on what basis' can be reconstructed afterward, neither regulatory response nor incident analysis holds. Raising autonomy and losing control are, properly, separate problems.

EU AI Act oversight requirements do not forbid HOTL. What they require is a state that can be supervised — not that a human attend every decision. With after-the-fact verifiable evidence, the oversight requirement can be met on the technical layer.

Lemma implementation

Lemma's position is explicit: the further a decision moves off the loop, the more the audit trail carries the accountability that human approval used to. Each decision's input hash, model version, inference timestamp, and output hash are pinned to a commitment chain, so even without a human signature "when, which model, on what input it decided" is preserved tamper-evidently.

In domains like agentic payments, where a human cannot approve each item, proving provenance via zero-knowledge proof becomes the functional substitute for human approval — the validity of a decision is verifiable without disclosing the data.

The result: HOTL is not 'autonomy that discarded control' but 'autonomy governed by evidence.' What Lemma provides is the verification layer for raising autonomy without lowering auditability.

Get started

Leave the loop without giving up auditability.