Learn
Inside-the-loop vs outside-the-loop
Every safety check sits somewhere, and where it sits decides what it can see – and whether the AI can talk its way past it. Inside the loop means the check runs inside the agent’s own program: a rule in your code, an instruction in the prompt, a second AI reviewing the first. Outside the loop means it runs at a door the agent has to walk through, between the agent and the model or its tools.
That sounds like plumbing. It is not. A check inside shares a program – and an attacker – with the thing it polices. A check outside does not, but it also does not automatically know what the agent was trying to do.
Checks inside the agent
A check inside the agent has the best possible view. It sees the plan, the working notes, how many times something has been retried, and it can step in halfway. For rules that depend on your own business – this customer is not eligible, that field must match our records – this is the right place for them.
What it gives up is independence. If the check is an instruction in the prompt, or another AI reviewing the work, it is doing the same kind of guessing as the agent it watches. The same trick that fools the agent – odd phrasing, a slow build-up over several messages – can fool the reviewer.
It also only covers what somebody wired up, so the gaps land where you are not looking: the automation tool nobody owns, the vendor product with nowhere to add a rule. And it sees one call at a time, with no natural place to track what the whole job has cost or that this is the eleventh near-identical attempt.
Checks at the door
A check at the door has the opposite qualities. It cannot be reasoned with, because it is not reasoning – what the model produced is text to be examined, not instructions to follow. It covers every application pointed at it, including the ones nobody thought to wire up. And it is the natural home for anything spanning a whole job: spending limits, spotting repetition, and one record of what happened.
The honest costs: one extra hop on the network, one more thing to run, and a narrower view. It sees questions, answers and tool calls. It does not see the variables inside your code, or steps that never involve the model.
How an outside check catches up
Models have no memory between calls, so the agent has to resend everything each turn – earlier messages, tool calls, results. Anything watching the eleventh turn is also looking at the first ten. That is enough to rebuild the story of a job while it runs, which is what makes whole-job rules workable from outside.
Knowing the intent is harder, and there are three ways to get it. Usually it is already written down in the instructions the agent was given – “check stock before confirming an order” – and each action can be compared against them. Or you state the rule directly: paying requires a supplier lookup first. Or in/guard/out learns what normal looks like and flags the unfamiliar – as a note, not a block, because unusual is not the same as wrong.
Where the human stands
The phrase has a second meaning, from decades of research into people supervising machines. In the loop means a person approves each important action. On the loop means a person watches and can step in. Out of the loop means nobody is really watching until something breaks.
In 1995, researchers Mica Endsley and Esin Kiris showed that people supervising automation get worse at taking over when it fails – watching passively does not build the understanding a takeover needs. Every “a human will approve it” design inherits this. Ask someone to approve everything and within a week they are clicking approve without reading. So spend that attention where it counts: on actions that are expensive or hard to undo, with a clear record for everything else.
Which check goes where
The question is rarely which one to pick, but which checks go where:
Keep inside
Rules that depend on your own data – eligibility, formatting, retries, what to show when something fails. Anything whose worst outcome is a poorer answer.
Move outside
Anything that must hold when the AI misbehaves: personal data leaving, which tools may be used, approval for risky actions, spending limits, the record. If a misbehaving agent could skip it, it was never a control.
Start where it is cheapest
One app and a strong team can start with a library in the code. Several apps or an auditor asking questions makes that the expensive path – the comparison page has the trade-off.
Frequently asked questions
What does “inside the loop” mean for AI guardrails?
The check runs inside the agent’s own program – a rule in your code, an instruction in the prompt, or a second AI reviewing the first. It sees everything the agent is doing, and shares the agent’s fate if something goes wrong.
What does “outside the loop” mean?
The check runs at a door the agent has to pass through – between the agent and the model, or between the agent and its tools. The agent cannot skip it, because the agent is not the one deciding whether it runs.
Which one is more secure?
Outside, for anything that must survive an attack – it cannot be talked out of it the way a reviewer sharing the agent’s context can. Inside is better for rules needing your own business data. Most real systems use both, with the security-critical checks placed where the agent cannot reach them.
What is the difference between human-in-the-loop and human-on-the-loop?
In the loop, a person approves each important action. On the loop, a person watches and can step in. Both drift toward being out of the loop – research since 1995 shows passive watching erodes the understanding needed to take over – which is why approvals should be rare and kept for actions that are hard to undo.
Does checking outside the loop slow things down?
It adds one network hop plus whatever checks you switch on. Simple rule-based ones take milliseconds; ones that ask another model take about as long as a model call. in/guard/out times every check so the cost is a number you read rather than one a vendor quotes.
Keep reading
See the checks run on your own traffic.
One base-URL change puts every request behind the guardrail pipeline. We’re running a limited demo – sign up and we’ll get you in as soon as we can.