The hardest design problem in an AI product isn't making the model smarter. It's making the person feel in control of it. I've been circling that question since university, where my research was on user interface considerations for emerging input device technologies. The input device has changed. The question hasn't.
"Human in the Loop" is the tagline on this site, so I should be able to say concretely what it means in the things I've built. Here's what it means.
Every inference is explicit
In the AI Lab apps, nothing generates on its own. Problem Solver proposes candidate problems when you click, analyzes the one you chose when you click, proposes solutions when you click, and builds a plan when you click. Agent Agenda has four generation actions and every one is a button. Promptpad enhances a draft when you ask and shows you the diff before you keep it.
That was a deliberate constraint, and it has costs. The apps are slower to use than they would be with speculative generation. But there is never a moment where output appears that you didn't ask for, and that turns out to matter more than speed. Agency is the thing people notice first when it's gone.
Approval is a checkpoint, not a formality
Sequential gating creates natural checkpoints, and the design makes them real. In Problem Solver you can go back to an earlier validated step without spending another inference. In Promptpad the committed revision is distinct from the active one, so you can explore and still return to the version you trusted. The person's judgment is stored state, not a modal you click through.
The same pattern runs my development workflow. Claude Code writes a plan, I approve the plan, then it executes. /diagnose produces hypotheses and stops before a fix. A checkpoint that requires a decision is a feature in a tool and a feature in a process.
Honesty about what happened
When the chat's Balanced model is unavailable and the fallback chain answers with a different one, the response says which model answered. The status badge and the reply label can disagree, and that's correct. I'd rather a visitor see the truth than a tidy interface.
The same goes for reasoning. The Thoughtful tier uses a model that produces reasoning traces, and the server preserves them for continuity. None of the three chats display them, because the prompts explicitly prohibit exposing structured reasoning to the visitor. Showing a model's scratchpad as if it were an explanation would be theater, and theater erodes trust faster than silence.
Consent that's real
Analytics on this site runs through a consent layer that's checked before anything fires. The chat panels on the Context First and prehog presentations route message text through a completely separate path from analytics, and a dedicated privacy test suite asserts that a typed message never appears in any captured event. Session replay, where it runs, masks every input and the entire chat dialog, and it's scoped to one page to answer one question.
That consent architecture started on one presentation and became a small shared library used across the site, because building it properly once made it obvious what everywhere else was missing.
The "would I use this" test
Every AI feature I ship has to pass one question: would I use this myself, on a bad day, when I'm skeptical? Auto-generated output that I'd have to undo fails. Hidden model swaps fail. A "thinking" panel that's really a transcript dump fails. Analytics I can't turn off fail.
What passes is boring in the best way. One click, one result, a clear label, a way back.
What enterprise buyers mean by responsible AI
At work, on a government software contract, "responsible AI" isn't a slogan. It's whether a reviewer can see what the assistant changed, whether the change ran through the same gates as any other change, and whether the person who approved it could explain why. Approval checkpoints, honest labels, scope control. It's the same list.
I don't think this is a temporary phase before the models get good enough to be trusted unsupervised. I think it's the design. The loop is the product.