Night QA left one ambiguous vision hold on screen and walked a line stop. Fifteen minutes later the hold auto-cleared to Approve. Morning found three escaped defects in the same family. The SOP still said “human in the loop.”
Shadow-mode diaries and operator-override telemetry are adjacent. This is specifically timeout policy that converts absence into consent.
Checklist — before you ship a review timer
| # | Question | If yes | |---|----------|--------| | 1 | Does timeout default to Approve? | Change to Hold/Reject or escalate | | 2 | Is the timer shorter than realistic review? | Lengthen or staff the desk | | 3 | Does absence page anyone? | Wire escalation, not silence | | 4 | Are timeout Approves tagged in genealogy? | Make them searchable scrap/escape causes | | 5 | Can a model vendor change the default remotely? | Lock under MoC |
Rules that keep the word “human” honest
Timeout must fail safe for the product risk—usually Hold or Reject, never Approve on ambiguous vision or safety-adjacent class scores. Every timeout decision needs a distinct reason code in MES so you can audit “approved by clock.”
Do not market HITL if the common path is an empty chair.
A countdown is a controller. Name it that way in the hazard analysis.