Reviewer gate log

process evidence

Human-in-the-loop primitive: records when the gate fired, the verdict (approved/rejected/amended), and the reviewer identifier.

What it is

Each RuntimeAISpec declares one of four reviewer gate modes: always-human (every decision queued for review), on-schema-violation (queued only when output fails the closed-enum schema), on-low-confidence (queued when model confidence below the spec's threshold), never (no human review).

When the gate fires, the L12 entry records the verdict (approved/rejected/amended) plus an optional reviewer identifier (operator-supplied — typically a user ID or role identifier).

The reviewer-verdict distribution across the chain is the audit-side proxy for 'is the human exercising meaningful authority?' under GDPR Article 22 (post-Schufa) and EU AI Act Article 14. A non-trivial override rate over time is the empirical evidence that human intervention is meaningful.

What it guarantees

Per-entry record of gate firing and verdict.
Override rate computable directly from chain — no parallel system required.
Cryptographic tying of verdict to specific decision (via L12 entry hash).
Operator-managed reviewer identifiers (no Promethean-side directory).

What it does NOT guarantee

Honest limits. Every primitive has them.

That the reviewer actually engaged with the decision substance — the gate records the verdict, not the depth of review.
That the reviewer was qualified or authorised — operator-side governance.
Real-time blocking — when always-human gate fires, the operator's queue handles the workflow.

Regulations that engage this kind

GDPR Art. 22

Meaningful human intervention

EU AI Act Art. 14

Human oversight of high-risk AI

California SB 1120

Clinician review of utilization-management AI

ABA Model Rule 5.3

Lawyer supervision of nonlawyer assistance

Sectors that rely on this kind

Related evidence kinds

L12 receipt chain

Hash-chained, Ed25519-signed log of every LLM-in-the-loop decision a Promethean-built product makes.

Fallback decision log

Records when the substrate fell back to a safe default after model failure or schema violation.

Spec hash commitment

Every L12 entry includes a SHA-256 of the active RuntimeAISpec, making silent spec drift detectable.

FAQ

How is 'meaningful human intervention' measured?

Not formally defined in any regulation. EDPB Guidelines WP251 + GDPR Recital 71 establish that human involvement must be more than 'a token gesture'. Empirically, regulators look at override rate over time — when reviewers approve 99%+ of AI recommendations, the implication is rubber-stamping. The substrate provides the per-decision data; your compliance team interprets the override rate.

Can the gate be disabled in production?

The gate mode is part of the spec, so disabling it changes the spec hash. The chain shows the transition explicitly — including before/after specHash, the date, and the entries decided under each configuration. There's no silent way to disable; auditability is structural.