AI Oversight Without Reviewing Everything

A support bot answers four thousand chats a week. A coding agent opens sixty pull requests a day. A quoting assistant drafts every proposal before a salesperson sees it. Nobody on your team reads all of that. Nobody can. So most companies land on one of two bad answers. Some review nothing and find out about failures from customers. Some try to review everything, fall behind in a month, and then quietly stop. AI oversight is the discipline of doing neither.

The useful idea is old. Airport security does not strip-search every passenger. A cheap scan looks at everyone. A small share goes to a second check. A smaller share again goes to a person with authority to say no. The cost of attention is spent where the risk is. AI oversight that works has the same shape, and recent research on reading the inside of a model has shown that same shape working at the activation level, which is the part of this story worth being hopeful about.

This post is the business half of a series on AI interpretability. The research half, which covers what is new inside the models, starts at AI's black box may be opening. Here the question is narrower: what should you check, in what order, and what should never leave a person's hands.

The three tiers

Every oversight design that holds up has three layers, and the layers differ by cost per output and by what they are allowed to decide.

1. First-line signal. Cheap enough to run on every single output. It does not decide anything. It sorts. A schema check, a rule check, a policy-word filter, a citation-present check, a classifier, or, for labs that can read the model's internals, an activation probe. Its job is to send most output through untouched and flag the rest.
2. Escalation review. Expensive, so it runs only on what the first line flagged. A second model grading the transcript. A reviewer reading the full trace. A re-run with a stricter prompt. This tier can change the verdict on a flagged item, but it never sees the whole stream.
3. A human on irreversible calls. Not a tier of cost. A tier of authority. Any action that cannot be undone, and any decision that nobody can grade, goes to a person no matter what the two tiers above said. Refunds past a threshold. Account closures. Outbound messages to a regulator. Anything the business would have to apologize for.

The order matters, and so does the direction of travel. Output moves up the tiers when something looks wrong. Nothing moves down. A cheap signal can never clear an irreversible action. That one rule is most of what separates oversight from theater.

Tier one: the cheap signal that sees everything

The first line has one job: look at every output without becoming the bottleneck. That rules out humans and it mostly rules out frontier models. What is left is anything deterministic and anything small.

On the outside of a model, the first line is rules. Does the response contain a policy statement, and is that statement grounded in an approved source. Does the deliverable make a claim with no citation. Did the agent call a tool it is not allowed to call. Did the number in the output fall outside the range the task allows. Each check is a few lines of code, runs in milliseconds, and gives the same answer on the same input every time, which is what lets you trust its silence on the bulk of output it waves through.

On the inside of a model, the first line can now be a probe. In September 2026 Goodfire published research (opens in a new tab) on catching reward hacking, the behavior where an agent games its success measure instead of doing the task, by reading a signal in the model's activations instead of its text. The probes are small detectors trained on the model's internal state. Goodfire describes the design this way: "a probe can act as an inexpensive, always-on first-line monitor, escalating suspicious behavior to the more expensive LLM monitor when necessary." That sentence is a tier-one and tier-two design, written by a research lab.

The result is scoped, and the scope is the point. Goodfire reports: "On Kimi K3, a probe + LLM combined setup reduces the cost of LLM monitoring by 90% with only a ~1% drop in precision." One model. One setup. One behavior. That is not a general law of monitoring. It is evidence that the cascade shape holds at the activation level, on a model whose weights the researchers could read. We cover what the probes catch and miss in reward hacking: when AI passes the test, not the task.

Tier two: escalation, and the cost of a false alarm

The second tier exists because the first one is cheap, and cheap means imprecise. Every signal has a threshold. Set it tight and you miss failures. Set it loose and you flood the reviewers. Goodfire makes the same point about its probes, noting that adjusting the threshold at which a probe fires gives "control over the tradeoff between catching more reward hacks and raising fewer false alarms." Your rule checks have the same dial. Someone has to own it.

What runs at tier two depends on what you have. A second model reading the full transcript and grading it against a rubric is the common choice for text. For agents, it is a trace review: what tools were called, with what arguments, in what order, at what cost. For a quoting assistant, it is a person with the pricing sheet open. The constraint is the same in every case. Tier two is slow and expensive, so it must only see what tier one sent up.

The complication nobody likes: the two tiers do not agree on what counts as suspicious, and that is a feature. Goodfire compared its activation probes to a chain-of-thought monitor on a coding benchmark and reported that the probes "catch 3.1% more hacks in Kimi K3 but 7.9% fewer hacks in GLM 5.2 on DeepSWE at a matched false positive rate." Neither monitor won. The lab's own summary: "Both techniques surface information that neither reliably does on its own!" The lesson transfers to your rule checks and your reviewers. Two different detectors that each miss different things are worth more together than one detector that is slightly better on average.

Tier three: the calls a person must make

The top tier is defined by the question "can this be undone," not by how confident the model was. A support bot can offer a discount and a person can reverse it. A support bot that tells a customer the company's cancellation terms, when no such terms were ever approved, has created a liability the moment the customer relies on it. That is the pattern the Customer-Facing AI Output Risk Triage is built around: a surface that can state policy with no grounding and offers no human escalation reads HIGH RISK regardless of score, and every HIGH RISK routes to human review, never a clearance.

The free Decision Fit Check applies the same logic one level earlier, before you automate a task at all. Eight questions place a task on a ladder from deterministic code up to a person, and two gates can push a task toward human judgment and never away from it. One gate is irreversibility: if a wrong answer cannot be undone and nobody sees it before it takes effect, the task routes to a person whatever a model would score. The other is gradeability: if two competent reviewers could not label two hundred examples and agree, there is no measurable right answer, so there is nothing to check a model against. A decision you cannot grade is one you cannot oversee.

Tier three also needs a stop that works. The person with authority has to be able to halt the system, and halting mid-task has consequences of its own. We cover what a real stop needs in AI agent kill switch: what to build before you grant access.

The inside view and the outside view

There are two ways to trust an AI decision. You can read it from the inside, which is interpretability: probes, traced circuits, neuron descriptions. Or you can gate it from the outside: verdicts on the output, evidence records, stop authority. The inside view is improving fast, and the research in this series is the reason to be hopeful about it. But it needs access to the model's activations. Goodfire's probes ran on open-weight models the researchers could instrument. Anthropic's circuit tracing ran on Anthropic's own model. If your AI is a hosted API behind a vendor's product, you have the model's words and nothing else.

So the outside view is the one that is yours this year. It is not a consolation prize. Every tier-one rule check, every tier-two trace review, every tier-three human gate works on outputs and actions, which you do have. A business that cannot see inside its model can still refuse to ship a claim with no citation, still block an action the domain rules forbid, still route the irreversible call to a person. The whole three-tier design runs on the outside. The inside view, where you can get it, becomes one more first-line signal feeding the same escalation path.

Building the tiers for your own system

The design takes an afternoon to draft and a quarter to make honest. The order below is the order the dependencies run.

1. List every surface. Every place an AI output reaches a customer, a ledger, a file system, or another system. The ones nobody remembers shipping are the ones that bite.
2. Mark the irreversible set. For each surface, which actions cannot be undone. Those are tier three by definition. Write them down before anyone argues about model quality, because model quality does not change the list.
3. Pick the first-line checks. One to three deterministic rules per surface. Cheap, reproducible, and allowed to flag, never to clear. If a rule needs a model to run, it is not a first-line rule.
4. Set the escalation path. Who or what reads a flagged item, within what time, and what they can decide. An escalation with no owner is a log file.
5. Record the evidence. For each decision: the output, the inputs it saw, the rule in force that day, and who approved it. Logs alone do not do this. The four parts have to join. See what an AI audit trail needs.
6. Drill the stop. Pull the kill switch on purpose, in a quiet week, and see what breaks. A stop that has never been tested is a hope.

If your agents call many tools across many systems, the routing of every model, agent, and tool through one set of checks is its own design problem, covered in enterprise AI control plane.

What tiered oversight does not solve

Three gaps stay open, and a design that does not name them is overselling.

The first line only catches what it was built to catch. Goodfire's probes were trained on short coding examples and generalized to shopping and customer-support tasks, which is encouraging. But a rule written for one failure is silent on the next one. The probe that catches gaming a test says nothing about a hallucinated citation. You need a signal per failure class, and the failure classes you have not met yet have no signal.

Monitors drift. The model behind your API changes without telling you. Your users' inputs change. The threshold you tuned in March is wrong in September. A cascade is only as good as the last time someone checked its false-positive and miss rates against real cases. Quiet drift in multi-step agents is its own failure mode, and the arithmetic is unforgiving: a chain of eight steps at 85% per step succeeds end to end about 27% of the time. That figure is arithmetic, not a benchmark, and it is the math behind the AI Agent Quiet-Failure & Drift Monitor Kit, which reads each agent as STABLE, SHORTEN, or CHECKPOINT from your own step counts.

Oversight has a price, and it lands on people. Every flagged item costs a reviewer's time. Every missed item costs more. The verification work your team already does on AI output is a real line item whether or not anyone has written it down. The Workslop Cost & Verification-Tax Calculator puts a figure on it per team from your own numbers, with no baked-in per-employee statistic, and reads each head as CONTAINED, LEAKING, or EPIDEMIC.

And one more honesty line, because the research is exciting enough to invite overreach. A probe that catches reward hacking is evidence that a model's internal state carries a readable signal for that behavior. It is not evidence the model is understood, and it is not a safety case. The research post does interpretability make AI safe lays out the steps between a readable signal and a system you can trust.

The outside view you can run this week

Everything below works on outputs, actions, and your own answers. None of it reads a model's internals, and none of it claims to.

• Triage the customer-facing surfaces. The Customer-Facing AI Output Risk Triage grades each surface on six controls from your own marks and returns LOW, REVIEW, or HIGH RISK, with the keystone gate described above. Nothing connects to your live systems.
• Place each task on the ladder. The free Decision Fit Check runs in your browser and sends nothing anywhere.
• Check the agent layer. aiagentsecurityaudit.com (opens in a new tab) is a free self-assessment of what your agent can reach, what connectors it holds, and what happens when it is wrong. You answer it yourself. There is no sign-up.
• See the gate logic as a diagram. The Visual Field Guide has free, embeddable diagrams of the gate that overrides a good score and the two finish lines every AI output has to cross.
• Run the instruments where you already work. If you own a RedHub instrument, the MCP connector lets Claude list and explain it in the chat, and run it when it ships a runnable engine. A run returns the verdict, whether the gate fired, what to fix first when there is something to fix, and the instrument's own disclaimer. It reads only what you own and cannot buy anything. RedHub is listed in Claude's connector directory and also tested the connector in ChatGPT and Gemini CLI on October 6, 2026.

The rest of this set

Four posts carry the detail. Reward hacking: when AI passes the test, not the task defines the failure the probes were built to catch and separates it from ordinary error. Why an AI's explanation isn't proof of its reasoning covers what counts as evidence that an explanation is faithful. Open models, closed APIs, and the right to inspect AI asks who can inspect what. And the AI inspectability checklist turns all of it into ten questions for any vendor, with a free PDF.

Keep going: the research set that precedes this one begins at AI's black box may be opening. For the reliability discipline underneath every tier, read AI reliability: how to know your AI actually works. For why confident output is the failure mode that slips past review, read confidently wrong AI.