How do I decide which AI actions need a human in the loop — and make that stick in practice?

Draw the line by consequence: anything that leaves the organisation or commits it is prepared by AI but reviewed, edited and explicitly approved by a person in an editable panel at the point of action. Nothing sends silently, the recipient sees an AI disclosure, and the interface enforces the rule — so it holds under deadline pressure instead of living in a policy document.