Human Oversight and Approval
A qualified operator remains the decision authority for every side-effecting action; copilots inform and propose, humans approve and own.
The human is the authority
Kronos copilots are decision aids, not decision makers. For every action with a plant side-effect, a qualified human operator is the approving authority: the copilot presents a proposal with its rationale, evidence, predicted margins, and uncertainty, and the operator approves, modifies, or rejects it. The copilot cannot execute a side-effecting action on its own under any circumstance.
What the operator sees before approving
- The proposed action and the objective it serves
- Twin-predicted effect with margins to envelope boundaries
- The evidence and reasoning trace behind the proposal, with citations
- The copilot's confidence and where it is uncertain
- The L4 authorization result (approved-pending-confirmation, or held)
Approval is informed, not rubber-stamped. The interface surfaces the reasoning so the operator can verify it, and low-confidence or low-margin proposals are visually distinct so they receive more scrutiny. The operator can drill from any claim into its source. This is the point of the grounding and provenance machinery: it makes the copilot auditable in real time by the person accountable for the machine.
Where humans are strictly required
| Side-effect | On safety path | Human approval |
|---|---|---|
| 0 | 0 | not required (read/analysis) |
| 1 | 0 | required |
| 1 | 1 | required + hardware interlocks retain authority |
| 0 | 1 | advisory only; hardware/L1 acts autonomously |
Fast protection is the one place the loop is not human-in-the-loop: microsecond-scale disruption mitigation on the breeder or potential-collapse protection on the burner is owned by L1 and the autonomous hardware failsafe, because no human can act on that timescale. The copilots advise around those systems; they never replace them. Everywhere slower, a human decides.
This oversight contract is not a limitation to be engineered away — it is the design. It keeps accountability with a qualified person, keeps the copilots honest (they must persuade a human, not just act), and matches the honest pre-FOAK posture: these machines are being built and commissioned, and the people building them stay in command. See L4 authorization and audit and provenance.