Human-at-the-Loop: Naming the External Axiom the Algebra Requires

Most "human-in-the-loop" talk treats the person as a safety net stretched under a weak system — there because the machine might fall, and ideally retired once the machine gets good enough. That framing quietly concedes that the human is a temporary patch. This argument inverts it. The need for something outside the system is not a weakness of the system. For the case I'll walk through, it is a theorem about the system — and the surprising part is that the theorem is silent on whether the something is a person at all.

Start with the failure the inversion fixes. When a system says "I can't determine that," you usually hear ordinary uncertainty: it doesn't know, maybe a better model would. That reading is almost always right, and it's why people assume the human net can eventually be removed — close the knowledge gap and you won't need the catch. But there is a second, sharper thing a system can do, and confusing the two is the error. A system can establish, with proof, that a particular structure lies outside what its own machinery can generate — not "I don't know," but "I can show this is unreachable from here."

A provable edge, not a blurry margin

We can do exactly that for a worked case. On one side, a negative result: a particular cyclic flow is not reachable by any composition of the system's own native operators — provably not, no composition equals it. On the other side, a positive result, machine-verified: the structure the system does carry — a concrete order-six flow on its nine-point geometry — with the non-commutative group of the same size constructed alongside it and proved unable to contain any six-cycle, closed in Lean with no gaps.

Put those together and the picture is not vague-and-limited. It is sharp on both sides: full strength where it's defined, and provably silent on its fenced zone — and it is that silence, that edge, we have closed in Lean. That division is the partition: a structural feature with a proved edge, and the opposite of a limitation — a limitation is not knowing where your edge is, and this is knowing exactly where your edge is, with a certificate. A map can be exact inside its border and still have a hard, provable boundary. Not a margin that better surveying erodes — an actual edge.

Because the silence is structural, no better model patches it. An axiom has to enter from outside the system's own algebra. And here is the load-bearing result: for the worked case, that an external attestor is required is now a closed theorem, machine-checked in Lean 4. Not assumed, not asserted as good practice — proved, and proved twice over, by two genuinely different mechanisms, so the result does not rest on a single lucky construction. The first is a finite-group separation: no internal operator equals the target flow — a group-theoretic argument that the flow is non-derivable from the system's own composition. The second is an information-dependency separation — a structural fact about what depends on what, with no person anywhere in it. Two different kinds of argument, same conclusion: an external attestor is provably required to stand across the partition. (The proofs are public: clone https://github.com/field-effect-institute/witness-independence-proofs and the Lean kernel re-checks every theorem on your machine.)

What the proof says, and what it pointedly does not

Read that result exactly, because the gap between what it proves and what it's tempting to read into it is the entire point of this article.

The theorem proves that an external attestor — something the system's own machinery cannot derive — is required. It says nothing about that attestor being a human. The proof does not show, and cannot show, that the thing standing across the partition must be a person.

I can make that vivid. Of the two independent mechanisms that establish the result, in one of them the external attestor isn't a person at all. There, the external attestor is an information-dependency separation — no human anywhere in it. So we have it shown twice that external does not mean human: the algebra forces an external attestor, and an external attestor can be an entirely impersonal thing.

So where does the human come in? "Human-at-the-loop" is the operational name we give to whatever stands in the partition — a name we choose, interpretively, on purpose. The algebra makes the partition; it does not staff it. What stands in it is a decision for the operator, not something the system forces. The step from "an external attestor is provably required" to "and that attestor is the human" is the one claim in this whole argument left deliberately untested — not because we forgot to prove it, but because it is not the kind of thing the proof is about. It is a choice about meaning laid on top of a result about structure.

I will not, at any point, tell you the human is provably required. The proof shows an external, non-derivable attestor is required. Naming that attestor "the human" is our interpretation, and we keep it labelled as one.

The discipline here is this: the structural part — the partition, the provable edge, the requirement for an external attestor — is settled, and I'm treating it as settled. The naming part — that the external attestor is the human — is a framework we hold open on purpose. We are settling the math, not its meaning; and we name the human-at-the-loop interpretively, on purpose, leaving the far side of the edge a question for the operator rather than a claim about the algebra.

A system can prove where its own edge is — and the human-at-the-loop is what we (interpretively, on purpose) name as standing on the far side of it.

Proofs for this series: github.com/field-effect-institute/witness-independence-proofs

Piece 2 of 3 | Series introduction: “To Figure Out How Humans and AI Should Work Together, We Had to Ask a Simpler Question First”
Previous: “Witness Independence: The Two Axes” | Next: “Pricing Independence: Fidelity SLAs as Witness Contracts”