Early on Monday, the operations team at a bus company opened the dashboard that ranked the night’s incidents. A model had labelled several routes “low delay risk” and placed a line through an industrial area near the bottom. The duty coordinator, Nuria, knew something the dashboard did not: roadworks had closed the secondary access and the overnight shift had reported that the diversion was filling with trucks. If she accepted the ranking, extra vehicles would arrive too late. She selected “raise priority,” stated the reason, and requested a reserve bus. The important question was not whether the tool had made a mistake. It was whether Nuria had real authority, time, and support to correct it.
Human oversight is often described as a checkbox at the end of an automated process. That is not enough. A person is not genuinely supervising when they can only confirm what a screen proposes, when they need several approvals to depart from a recommendation, or when their correction is logged as an anomaly that harms their assessment. In transport, an automated classification can sort faults, estimate demand, allocate inspections, or prioritize safety alerts. Its effects reach drivers, passengers, and neighbourhoods quickly. Effective human authority means being able to understand, change, stop, and review a classification without paying an unreasonable price for doing so.
A recommendation is not a disguised order#
The team’s first agreement was to name every output accurately. The dashboard did not “decide” which route deserved attention; it proposed a priority from punctuality records, occupancy, prior alerts, weather, and available vehicles. Changing the verb resolved a familiar confusion. If it is called a decision, an intervening worker looks as though they are disobeying a judge. If it is called a recommendation, that worker is doing their job: testing a limited signal against a real situation.
The team’s first agreement was to name every output accurately. The dashboard did not “decide” which route deserved attention; it proposed a priority from punctuality records, occupancy, prior alerts, weather, and available vehicles.
To make that distinction practical, the screen had to show the main reasons for each ranking. A red or green label was not enough. For the industrial route, it displayed historic punctuality, low occupancy in recent weeks, and no incidents during the previous month. It also had to show what was missing: the model did not receive live roadwork notices and did not know that the diversion removed a stop used by people arriving for an early shift. A useful explanation does not promise to expose every calculation. It allows staff to see what evidence is influencing the output and what context is absent.
The company added a simple rule: any duty worker could raise or lower a priority when they supplied an observable reason, such as a road restriction, an expected gathering, an accessibility warning, or a driver’s recent report. They did not have to prove the system was “wrong.” They had to explain why its recommendation was insufficient at that moment. The correction was stored beside the original output so the organization could learn from the case, not treat it as disciplinary evidence.
Authority requires resources, not merely permission#
An override button is useless if no vehicles, staff, or channels exist to carry out the alternative. In an earlier trial, supervisors could change priorities, but the assignment program still locked the reserve bus unless a remote manager intervened. The autonomy was decorative: a human alert became a chain of calls, and time was lost anyway. The team learned to distinguish a formal right to intervene from the material ability to do it.
They set three action levels. The first allowed immediate local adjustments: request an inspection, notify route staff, move the departure time of a relief vehicle, or escalate an incident. The second activated shared resources, such as a reserve bus or traffic support, with a named person available within minutes. The third suspended an automated rule when several corrections pointed to the same risk. None required technical language to justify intervention; each asked for a clear description of the situation and produced proportionate traceability.
Traceability needed limits as well. If every change required a long report, staff would avoid intervening in uncertain cases. If nothing was recorded, the organization could not examine abuse, error patterns, or training needs. The final form contained four short fields: initial classification, action taken, evidence for the change, and observed effect when known. A choice such as “priority raised because a road closure was confirmed” took less than a minute. Later review was intended to improve rules and resources, not make every worker defend their use of judgment.
Undoing is more than changing a label#
The word “undo” covers different decisions. Sometimes it is enough to move a route from low to high risk. At other times, a team must withdraw a classification that stigmatized a driver, cancel an unjustified inspection, or prevent a neighbourhood from receiving less service because of a poor prediction. Before testing new automation, the team made a consequence map. For every system output, they asked: who is affected, what resource is distributed, how quickly does the effect occur, who can reverse it, and what repair is needed if harm has already occurred?
The map exposed an asymmetry. It was easy to correct a demand prediction before a timetable was published. It was harder to repair a service reduction that left people waiting in the rain, or an alert that triggered an unnecessary conversation with a driver. High-impact classifications therefore could not take irreversible effect. Before cutting frequency, the system generated a proposal visible to the local team. Before opening action about a person, it required independent human verification and an explanation of the specific fact that justified the step.
Human review should not sit in a single isolated role. Drivers, maintenance workers, customer-service staff, and passenger representatives see different parts of the problem. The company created a channel for a driver to report that a maintenance priority missed an intermittent noise, and another for passengers to flag an inaccessible stop that did not appear in delay data. Those reports did not automatically alter the dashboard, but they reached someone able to act and were grouped as evidence. Distributing observation reduces the risk that the tool becomes the only accepted account of what is happening.
Review overrides without punishing judgment#
A week after the roadworks case, the team reviewed interventions. It found that three outer-area routes had been ranked as low urgency because they showed low early-morning occupancy. Supervisors had raised them because two industrial estates had changed shifts and a road was partly closed. Rather than asking who had “failed,” they compared the pattern: the model used delayed aggregated counts and did not include announced employer changes or municipal works. The response was to open two verified notice sources and schedule a fairness review of predictions by area and time band.
They also reviewed corrections that did not work out. One supervisor requested reinforcement for a route because of a concert rumour, but the information was not confirmed and the vehicle was needed elsewhere. The case was not used to remove her authority. It helped establish which sources were sufficient to mobilize scarce resources and how to label provisional decisions that could be reconsidered when new information arrived. Oversight learns when it can admit uncertainty; it weakens when only completely correct interventions are treated as legitimate.
The joint committee published understandable monthly indicators: how many recommendations changed, why they changed, how long responses took, which areas received more mistaken classifications, and what corrections followed. It did not publish individual names or turn override rates into a performance table. A high rate might mean staff recognized missing context well; a low rate might reflect reasonable confidence or fear of disagreeing. The figures required discussion, not automated use against people at work.
A test for authentic supervision#
Before deploying a new classification, a transport team can run a concrete test. Give a duty worker a plausible case containing information the system does not have: a closure, a broken lift, a demonstration, or a shift change. They should be able to identify the limitation, adjust the priority, activate the necessary resource, and leave a brief note. Then check whether someone reviews that action to improve the tool and whether the worker is protected when they acted in good faith. If any of those steps fails, the organization has the appearance of human control rather than effective authority.
Nuria did not replace a machine with arbitrary intuition. She used situated knowledge, offered a verifiable reason, and started an alternative that the system could not imagine from its data. Her intervention mattered because it was designed as part of the service, not tolerated as an exception. For an automated classification to help transport, it must be reversible where it distributes time, safety, and access. When the next recommendation appears, the operating question should not be “do we obey it?” It should be “who can correct it now, with what evidence, and with what resources?”
