What is the difference between human-in-the-loop and human-on-the-loop?

Meridian Payments runs Sentry Flag, a tool that scores every transaction for fraud risk in real time. Beatriz Salcedo is a fraud analyst who wears a headset through most of her shift, working a stream of flagged transactions that have already gone through by the time she looks at them.

How to answer this, stage by stage

Nobody is grading whether you can recite two definitions. They're grading whether you can say which one a specific action actually needs, and defend it.

Let's learn

Say we build a fraud system that has to make one decision, over and over, thousands of times an hour: block now, or let it through and look later.

Sentry Flag reads every transaction Meridian processes, card purchases and real-time bank transfers alike, and scores it for fraud risk in about 40 milliseconds. Before it, Meridian held every transaction over 2,000 dollars for manual review, a blanket rule that added a 45-minute average hold to any large purchase, card or transfer, no matter how routine.

One design stops you before you pass. The other only knows you passed.

Now most transactions clear instantly, and only a small tier gets held for a person's approval before completing at all. Everything else, including plenty of large ones, moves through immediately and reaches Beatriz's review stream afterward.

Here's the turn: the split between "block first" and "review after" was never really about the dollar amount. It was about whether the money could still be pulled back once someone looked, and a rule built around size alone quietly stopped asking that question.

The gap didn't open the day instant transfers launched. It opened the day someone noticed the rule didn't ask about them differently.

At its worst, a fraud ring finds the gap before anyone else does: thousands of instant transfers, each small enough to clear Meridian's dollar threshold, none of them reversible once the recipient cashes out, all of them technically caught by Beatriz's review, and none of that catching worth anything by the time she sees it.

Two boxes the same size on a dashboard. Nowhere near the same size once you ask what a review can still do about them.

What I would leave alone: routine card purchases stay human-on-the-loop, full stop. Chargeback rights already give them a real path back, so blocking them would just add friction with nothing gained in return.

The lesson: the two modes were never a spectrum of trust in the model. They're a question about whether tomorrow can still fix today's mistake.

Now here is the same thing as a story

The short version above is what you'd say defending this fix to Meridian's risk committee. Read this one for how the gap actually got found.

Beatriz Salcedo has worked fraud review at Meridian for five years, and she is the one who once traced a wave of card disputes back to a single compromised merchant terminal, three weeks before the card networks flagged it themselves.

Meridian's instant transfer product launched quietly, aimed at people splitting rent or paying a contractor same-day, and it inherited the existing dollar-based rule without anyone specifically re-checking whether that rule still made sense for a payment type with no reversal window.

The question was always sitting right here. Nobody had asked it specifically about the new payment type.

A fraud ring found the gap within weeks: thousands of instant transfers, each just under Meridian's block threshold, moved through instantly, reviewed only after the fact, and by the time Beatriz's queue flagged the pattern, every recipient account had already been emptied and closed.

A routine quarterly risk audit, the same kind Meridian ran every quarter without expecting anything unusual, sampled recovery outcomes across payment types and found the 2-percent recovery rate on instant transfers sitting next to card fraud's 78 percent, same review process, wildly different result.

Dollar amount isn't on this list. It was never actually the thing that mattered.

With the redesigned split, instant transfers above a much lower threshold move to human-in-the-loop, blocked until Beatriz or a teammate actively clears them, regardless of how the dollar amount compares to a card transaction. Run the same quarter forward: the ring's pattern gets caught at the third or fourth attempt, blocked before completion, instead of thousands of transfers deep before a routine audit finally connects the dots.

The old rule asked how big the transaction was. The new one asks whether tomorrow can still undo it.

I built the split around dollar amount because it had worked fine for years on a system that was only ever card transactions. It took a routine audit, not a dramatic breach, to see that a new payment type had quietly broken an assumption nobody had actually written down.

PICK, in one screenNot a debate about which mode is "better." PICK is what tells you which one a specific action actually needs.

The recap, one line per letter: position is in-the-loop for anything irreversible, on-the-loop for anything that isn't, impact is friction against permanent loss, cost asymmetry is that the hidden, unrecoverable loss is the one to design against, and kill criteria is that a real reversal window would change the pick entirely.

And if you want to be sure it really works, try it somewhere elseSame four letters, a telehealth pharmacy instead of a payments company. A different kind of "can't take it back."

Fernglade TeleRx auto-approves routine refills of a patient's existing, stable medication, at the same dose, no pharmacist review before dispensing. Ansel Meurer is a pharmacy technician who reviews a sample of those refills after they've already shipped.

Mapped onto PICK: position is human-on-the-loop for a stable refill at an unchanged dose, human-in-the-loop for any new medication or dosage change. Impact is that reviewing a stable refill after shipping costs almost nothing, since the patient's body already tolerates that exact dose, while reviewing a new or changed dose after it's been taken costs something that can't be undone once swallowed. Cost asymmetry is that a dispensing delay is cheap and visible, while an already-ingested wrong dose is the hidden, permanent one. Kill criteria: if a medication change could be safely reversed by simply not taking the next dose, on-the-loop might be defensible even there.

Swap "transfer" for "dose." The same gate-versus-watch question decides the same way.

Swap the trigger and it still runs.
Speed: an interviewer caps you at sixty seconds. Say "in-the-loop blocks, on-the-loop watches, and the real test is whether tomorrow can undo today's mistake," and stop.
Cost: there's no engineering time to build a reversal-aware routing system this quarter. Say so honestly, and start by manually reclassifying any payment type with no chargeback right into the blocking tier.
The model gets better, for real: even a much more accurate fraud model doesn't change which mode a payment type needs, since the split was never about model accuracy, it was about whether the harm can be undone.

Where people run it wrong.
They pick the mode by how risky an action feels, rather than by whether it can actually be reversed once flagged.
They copy a threshold from an older product onto a new one without re-checking whether the new product even has a way back.
They treat "we caught it eventually" as equivalent to "we stopped it," when for an irreversible action those are two very different outcomes.

How to use it live. When someone asks for the difference between the two modes, answer with the reversibility question first, then the definitions. It's a stronger answer, and it's the one that actually decides real cases.

Flashcards (tap any card to flip it)

Check yourself Score: 0 / 0