“Human in the loop” means a person approves each action; “human on the loop” means the system acts autonomously for routine tasks — flying, perching, tracking — and a person supervises with the ability to intervene. Tencer systems run on the loop for movement and observation and require explicit, logged human authorization for any consequential action, including any use of force in authorized government configurations. Civil configurations carry no force capability at all. See our responsible-autonomy doctrine.
Why the distinction matters
Fully human-in-the-loop control does not scale: one person cannot approve every movement of forty machines. Fully autonomous control is unacceptable for consequential actions. On-the-loop control assigns each to the right party and makes the boundary explicit and auditable.
What to ask vendors
Which actions does the system take without approval? How is approval for the rest enforced — in software policy, in hardware, or both? Is every approval logged with identity, time and context, and can that log be exported to oversight bodies?