Why some decisions cannot be fully automated
Certain categories of decision are, by design, not meant to be reducible to a rule a machine can evaluate alone: a change to the policy engine itself, a change to who holds root authority, a genuine exception to an existing rule. Automating these away removes the one check that exists specifically to catch situations the rules did not anticipate.
A well-designed system draws this line explicitly, naming the categories that require a human decision rather than leaving it to whoever happens to be building a given feature to decide whether their case is 'routine enough' to skip review.
Making human review real, not theatrical
A human-in-the-loop step is only meaningful if the human actually has the context and the authority to say no, and if their decision is recorded with the same rigor as an automated one. A system that requires 'approval' but presents so little information that the reviewer rubber-stamps every request, or where the same person can both request and approve, has the appearance of governance without its substance.
The opposite failure mode is routing too much to humans: if every routine action needs manual sign-off, reviewers become desensitized and start approving quickly without real scrutiny, and the genuinely risky requests get lost in the volume. Human review works best when it is reserved for the categories that actually warrant it, and applied consistently to those.