Human-in-the-Loop Migration: The Right Balance

Not a Slogan — a Set of Gates

“Human in the loop” usually means a tool showed someone a diff at some point. That is not a control. A real one is specific: which operations stop and wait for a person, what that person is shown, and what happens if they are not there.

The Confirmation Gate

Anything that changes a target database — creating, dropping, truncating, loading — stops and asks. Not once per session: every time. Approval is per-action, and it does not generalise from a previous yes, because the whole point of the gate is that the fifth action is not the one you agreed to.

The prompt names the operation, the object, and the target. A confirmation dialog that says “proceed?” without saying to what has trained the user to click yes, which makes it worse than no dialog at all.

Read Freely, Write Never

The design asymmetry that makes this workable: reading is unrestricted, writing is gated. The assistant can inventory a schema, profile columns, transpile code, estimate a plan, and read a validation report without asking permission for any of it — none of those change anything. That is what keeps the gate from becoming noise, and noisy gates get automated away by the people they are meant to protect.

Every Tool Call Is Logged

A gate you can’t audit is a promise, not a control. Every tool invocation — what was called, with what arguments, what it returned, and whether a human approved it — is written to an append-only log. That log is what makes a post-mortem possible, and it is the reason “the tool did it” can be checked rather than argued about.

Where Judgement Genuinely Belongs

• Semantic ambiguity. Did that empty string mean “unknown” or “blank”? The database cannot answer; the person who knows the application can.
• Port or rewrite. A 1,400-line package with three autonomous transactions might not deserve a faithful port. That is an ownership and maintenance question.
• Acceptable downtime. Sets the entire cutover strategy, and it is a revenue question, not a technical one.
• Go/no-go. The tool reports what validation found. Whether that is good enough to flip the connection string is a person’s call, with their name on it.

The Failure Mode to Avoid

Human-in-the-loop fails in a specific way: the human becomes a rubber stamp. Show someone four hundred confirmations and they will approve all of them without reading. The defence is to make the gates rare and meaningful — gate on consequence, not on activity — which is exactly why read operations don’t ask and destructive ones always do.