Trust and Override: Keeping the Human in Command
How the interface lets an operator accept, question, or overrule the AI — with the context to do so well and a record of why.
The AI advises; the human commands
Kronos L6 is built on a firm hierarchy: the L1 hardware failsafe is always authoritative, and above it the human operator can accept or overrule any advisory the AI produces. The UX's job is to make override a well-informed, low-friction, fully-recorded action rather than a panicked stab at a button. Good override design is what makes automation safe to deploy at all.
Three responses to any AI recommendation
| Operator action | What the UX provides |
|---|---|
| Accept | one confirming action; confidence + provenance shown first |
| Question | drill into inputs, forecast, and the model's reasoning |
| Override | substitute the operator's decision, with a reason captured |
Every recommendation arrives with its confidence, its provenance badge, and — from L5 copilots — a short rationale. The operator is never asked to accept a black-box command. When they override, the UX asks for a brief reason (chosen from common categories plus free text), which becomes part of the incident record and, later, training signal for where the model and human disagreed.
Matching automation level to trust
Not everything should demand the same human involvement. The interface exposes the current automation level per control loop and makes changing it deliberate. Fast, well-characterized loops (breeder vertical stability, burner plug density) run closed-loop in L1 with the operator supervising; slower, higher-consequence decisions default to human-in-the-loop. When a model's badges go amber (out of distribution, miscalibrated, degraded inputs), the UX proactively suggests lowering the automation level.
- Override is always available and never punished by the interface
- Override requires context to be shown, and a reason to be recorded
- Automation level is visible, per-loop, and deliberately changed
- Disagreements (human vs AI) are logged as first-class training data
This is only trustworthy because uncertainty and provenance are honest — see uncertainty visualization and provenance display. Every accept/override is captured for audit and replay.