Edward Meyman. August 2026 (Version 2.0 of the technical note; original April 2026).
The presence of a human in the decision path is often taken as evidence of governance. It is not, by itself, evidence of anything except that a human is present.
Two arrangements look alike in a workflow diagram. In the first, a guardrail fires on an output or a behavior, a human reviews the flagged action, and the workflow proceeds or does not on the human's say-so. In the second, a runtime authorization boundary evaluates a proposed action against the governing policy before it executes; where the applicable authorization state does not resolve the action, or where policy reserves it for a named human authority, the boundary returns ABSTAIN, execution stays blocked, and an authorized human supplies the input that lets the boundary resolve the held action. Both put a person near the moment an AI system might act. Both interrupt the action's path. Drawn coarsely enough, they are indistinguishable.
The similarity is an artifact of diagram resolution. The technical note states the rule that separates the two, and the rest follows from it.
A human decision becomes part of authorization only when a non-bypassable, fail-closed runtime authorization boundary materially consumes the human's authority-bound input to emit the action-bound verdict on which execution depends, and that verdict is represented in an independently reconstructable authorization artifact.
Three things have to be true at once. The human's input must be consumed by the boundary, not merely recorded beside it. Execution must be unavailable without the verdict that boundary emits. And the verdict must be represented in an artifact a third party can reconstruct without access to the governed system. Participation that fails any of the three may support an authorization process, but it does not itself constitute authorization.
The sequence is fixed. A human supplies input. The boundary emits the verdict. The authorization artifact represents the verdict. The human does not emit the verdict, and the override does not produce the artifact.
Three axes
The two arrangements differ on three independent axes.
Trigger basis. A guardrail is triggered by an output or a behavior: a classifier fires, a pattern matches, a threshold is crossed. The question it answers is whether this output looks bad. ABSTAIN is triggered by the relationship between the proposed action and the governing policy: either the applicable authorization state does not resolve the action, or the policy reserves the action or action class for a named human authority. The question it answers is whether this action is authorized under the policy in force. Those are different questions, and a guardrail and an authorization boundary can disagree about the same action.
How the human's determination enters the architecture. This is the axis that carries the argument. Under review-only human-in-the-loop, the human's determination is consumed by the surrounding workflow. The workflow proceeds on it, and usually records it. Nothing at an authorization boundary consumes it, because there is no boundary in the path whose verdict execution depends on. Under ABSTAIN with authorized resolution, the human's determination is authority-bound input to the boundary. The boundary consumes it, together with the policy and the governed state, and emits ALLOW or DENY for the held action. Execution depends on that verdict and on nothing else.
What the record is. A review record is evidence that a determination occurred. It carries the human's confidence at the moment of decision, and reproducing it requires access to the human. An authorization artifact is evidence of why the action was permitted or prohibited under policy. It binds the inputs, the policy and evaluator state, the authority chain under which the human's input was supplied, and the verdict, and a third party can reconstruct the verdict from it without contacting the original system or the original human.
A review record is evidence that a determination occurred. An authorization artifact is evidence of why the action was permitted under policy.
The artifact difference is not a recordkeeping preference. It is what the second axis looks like after the fact.
Two consumptions, one required
The April formulation of this note said that an override codifies into the active constraint set and binds future verdicts. Version 2.0 separates two things that sentence ran together.
The first consumption is required. The boundary consumes the human's authority-bound input to emit the verdict on the held action. Without it, the action was never authorized, whatever else happened.
The second consumption is optional. An authorization architecture may have a separately authorized policy-amending pathway: an assurance function that evaluates a proposed policy amendment under its own authority, consumes authorization artifacts as inputs, and may return ALLOW on the amendment only if the validated content of those artifacts supports it. Where that pathway exists and is used, the artifact representing the boundary verdict on a held action can later be consumed to change the policy that governs later actions in the covered class. Where the pathway does not exist, or the organization deliberately withholds it from an action class, nothing about the first consumption changes.
Resolving a held action and amending the policy that will govern later actions are two authority acts. They may compose. They are not the same act, and nothing in the definition of authorization requires the second to follow the first. That second act changes future policy. It is not what authorized the held action.
What the workload claim is, and is not
The April note said that human labor under guardrails scales with action volume and under override scales with policy incompleteness. Version 2.0 states the comparison as workload functions over fixed-policy intervals, for both arrangements, and makes no claim that either is cheaper.
The note's only rate claim is narrow. Within a covered recurring action class, under declared conditions, and only where a policy-amending pathway exists and is exercised, the rate at which that class returns to a human can fall as the policy comes to resolve it. Review-only arrangements have no such mechanism, because no determination propagates into anything future determinations consult. Outside those conditions the note claims nothing about rates, and reserved action classes, where every action returns to a human by design, fit the model without qualification: the reservation is the policy, and the boundary enforces it.
High ABSTAIN rates in a new deployment are not a failure mode. They are a measurement of how much of the action surface the policy does not yet resolve, or reserves. The two arrangements may require comparable human attention in their first months. The work is architecturally different: in one case the human's determination is consumed by a workflow and recorded, in the other it is consumed by the boundary and represented in an authorization artifact that can be reconstructed later.
How they degrade
Under sustained volume, review-only arrangements degrade without authorization-grade evidence. A review record shows that a determination occurred, not whether meaningful review took place, and nothing in the record lets a third party tell the difference.
ABSTAIN with authorized resolution degrades traceably with respect to policy, authority, and verdict. Every resolution is represented in an authorization artifact that binds who supplied the input, under which authority, against which policy state, and what the boundary returned. Whether a pattern of permissive resolutions amounts to drift is a separate analytical judgment over that record. The artifacts do not render that judgment; they make it possible.
Within or around
On the Impossibility of Observability-Based Authorization establishes that no observability architecture can produce the authorization artifact an ex-ante regime requires. Its sixth criterion, Override Governance, requires that human overrides operate within the enforcement architecture rather than around it, as a corollary of non-bypassability: if an execution path exists that the boundary does not govern, the boundary is not non-bypassable.
The three-axis distinction is the operational reading of that criterion, and the Authorization Non-Substitution Principle states the general rule it instantiates. Authorized resolution is override within: the boundary consumes the human's input and emits the verdict. Review-only human-in-the-loop is override around: a determination is made outside the boundary and the workflow proceeds on it. A human's visibility in the diagram does not tell you which one you are looking at.
Review-only HITL may determine what the immediate workflow does, but it does not constitute authorization unless the human's authority-bound input is materially consumed at the runtime authorization boundary and execution depends on the resulting action-bound verdict. A separately authorized policy-amending pathway may later consume the resulting authorization artifact, but that second act changes future policy and is not what authorized the held action.
The note is not a vendor takedown. Guardrails and human review have legitimate roles, and human review incorporated into an authorization procedure is not review-only. The claim is only that a guardrail with a review-only human attached does not constitute an authorization procedure, and that the human's presence does not promote it to one. The note specifies properties, not implementations, and makes no claim about any particular system, including any FERZ system.
The full development, including the definitions, the workload functions, the boundary conditions, and the doctrinal mapping to the Five Tests Standard and the Composition Test, is in the technical note. Version 2.0 supersedes the April formulation; Version 1.4 remains on the record as the April formulation.
Technical note: The Override Asymmetry: Why ABSTAIN with Authorized Resolution Is Not Guardrails with Review-Only Human-in-the-Loop, Version 2.0, August 2026. Concept DOI 10.5281/zenodo.19772248. Version 2.0 DOI 10.5281/zenodo.22037126. The note is available in the FERZ research community on Zenodo.