Anthropic’s usage policy puts autonomous physical operation in a high-risk category that requires a human in the loop, and separately bars using its models to arm drones. My conclusion is that the risk tier is right and the boolean is wrong: what belongs in that sentence is a set of numbers, not a person’s presence. The drone clause is uncontroversial. The human-in-the-loop clause looks like a bright line and is not one, because it carries no engineering content. It does not say how fast the human must respond, how many machines one human may hold, what the robot does when the human is unreachable, or how any of it is verified.

Automotive went through this phase. “The driver is supervising” was both the regulatory and the marketing answer to level-2 assistance, and it satisfied nobody — not the regulator who had to define supervision, not the insurer pricing it, not the engineers implementing a sentence with no threshold in it. What moved the industry was quantification: a declared ODD, a measured takeover time, a published operational number, argued inside a taxonomy everyone had agreed on.

The timing is the interesting part. The same week, Anthropic published research showing a 9B model running inference on eight of the nine hardware classes it tested, with 30B-and-below models completing most individual steps of autonomous replication; Epic Games moved to an AI-first pipeline where Claude writes all the code and directs all the art on a project tied to a $1.5bn Disney partnership; and QGIS merged QEP428 on 2026-10-07 declaring AI-assisted contributions NOT ALLOWED. Three policy postures toward machine autonomy in one week — and only one concerns a domain where a wrong action can be undone.

What I concluded

Naming physical action as its own risk surface is correct and overdue. Expressing the control as a boolean is the mistake. The line that matters is not human versus no human; it is reversible versus irreversible error. A software agent that leaves a background daemon running after you close the terminal — Codex CLI 0.157.0 does exactly this by default, with codex app-server --managed-daemon — is an annoyance you end with a process kill. An arm moving through a shared aisle is not undoable, and “the operator was watching” does not reverse the outcome.

What should be written instead is a quantified human-in-the-loop specification with four numbers: teleoperation ratio (share of runtime or task attempts that genuinely needs a remote human), takeover latency as a distribution with a stated P95, operator concurrency (robots per trained operator per shift), and the minimum risk state the robot enters when the human link fails. A fifth, if allowed: the authority model — what the robot may do when it cannot reach a human and stopping is the worse option.

That reframes the question. “A human must be in the loop” asks whether someone is watching. “Disclose your teleop ratio and your takeover P95” asks whether the deployment is actually supervised. Only the second is auditable.

Constraints

Four constraints decide how far this gets.

Vocabulary. ADAS inherited a coarse but shared taxonomy of levels and a shared concept of ODD. Mobile manipulators and humanoids have no equivalent: no agreed definition of a task, no ODD language for mixed-traffic warehouses, no rule for when a model version change makes it a different deployment. Without that, a teleop ratio is not comparable across vendors.

Measurement culture. Automotive has a reporting habit for disengagements and mileage. Robotics has demos. There is no public benchmark for takeover latency in manipulation and no cross-vendor reporting of operator concurrency, so the numbers I am asking for have to be built by each deployer rather than compared against a norm.

Split incentives. Model providers inherit the compliance obligation, integrators carry the deployment cost, the site carries the physical risk. Nobody in that chain is naturally funded to measure.

The constraint that decides the outcome: auditability asymmetry. A boolean is cheap to check, and therefore attractive to a regulator with no robotics headcount. A P95 requires telemetry, definitions and a competent auditor. Policy gets written at the level of what can be verified — which is exactly why the boolean survives unless deployers bring the numbers first.

The options, and what I traded away

I would deliberately run the second option during data collection and contract to reach the third. What I traded away is the comfort of pretending the checkbox was sufficient.

Evidence

The reversibility asymmetry is directly observable. Codex CLI 0.157.0 opening a persistent managed daemon when an interactive session starts is a real agent-containment failure, recoverable in seconds. QGIS can declare AI-assisted contributions NOT ALLOWED (QEP428, merged 2026-10-07) because its worst case is a bad patch in a review queue. Epic’s Claude-driven pipeline can iterate because the artefact is code and art. Those domains can afford blunt policy because a wrong action is reversible. Physical action is the one category where that assumption fails — which is why I accept the risk tier and reject the boolean.

Capability is documented too: Anthropic’s own research shows 9B models running on eight of nine tested hardware classes, with 30B and below completing most single steps of autonomous replication. Read that as a forecast about cheap autonomy attempts, not about robots doing useful work.

What I am not treating as evidence: the automotive record, which I can describe structurally but will not quote as a benchmark here. And no public dataset exists for manipulation takeover latency, so my four numbers are a proposal, not a standard.

Where this stops being true

Inside a fenced cell with hard interlocks and one repeated task, “no human inside the fence while the cell runs” is correct and sufficient, because the fence is the control and the human is not. The boolean is right there.

Fleet size: below a handful of units — order of one to ten — the operator is effectively the integration layer and a takeover P95 is theatre. The argument bites once the operator-to-robot ratio reaches a hiring plan.

Segment: this is about unstructured, multi-task manipulation in spaces shared with people. A fixed-track AGV in a closed aisle is a different problem with a defensible fixed rule. And the numbers themselves move: if a coming VLA generation pushes interventions down to exception handling, the four metrics are still the right specification while their acceptable values shift a long way. Today’s numbers are not the target.

Company size and region: a small team cannot fund the measurement stack, and what a deployer must file differs by jurisdiction. Proportion the spec to the fleet and to who owns the risk. The argument also stops being true in the good way if standards bodies put the numbers into the rule — then a boolean attestation is fine, because the standard carries the engineering content.

What I would do differently

If I were drafting the clause, I would keep the risk tier and replace the condition: disclose teleop ratio, takeover latency with a P95, robots per operator and minimum risk state at deployment, and update the disclosure when the model or the operating domain changes.

If I were buying, I would put those four numbers in the contract with a test procedure and a remedy, and refuse “the operator is in the loop” as an answer to a technical question.

If I were deploying, I would instrument the human link before adding robots — link loss, takeover latency and minimum-risk-state entry as first-class telemetry — and cap concurrency at what is genuinely supervised, raising it only with data.

The wider lesson from ADAS is that the industries which measured got the better regulation. Robotics should start that measurement culture before an incident makes it mandatory, because boolean rules that fail do not get refined. They get replaced with something much blunter.

This post is part of my personal AI agents guide.