Human-in-the-loop write gating
Require verified sign-off before anything enters the official record — govern the write, not just the read.
What it changes
Who can pull it
What it looks like institutionally
The moment an output is written into the case record, it acquires a future: it will be read, believed, retrieved, and repeated. Write gating puts the human control at that moment — nothing enters the permanent record without a named person verifying and co-signing it.
Gating the write is stronger than reviewing the output, because outputs that are merely seen can still be informally trusted, while records persist by default. It concentrates scarce attention on the single action with the longest consequences.
Its cost is honest friction: gated writes are slower writes. Pair with pacing, and resist the degraded version — bulk approval screens — which preserves the ritual while deleting the control.
Addresses: Error documented into permanent records · Direct machine writes. Test a version of this lever in the PAN Lab.