Human in the loop by design: why every AI change is staged
By The Corra team · · 2 min read · Product
Every change the Corra copilot proposes is staged rather than saved: you see the exact edit, you accept, adjust or discard it, and only then does anything reach your data. This is a hard architectural rule in the product, not a preference in a settings panel, and it costs a click on purpose.
The failure mode we are designing against
A copilot that writes directly is impressive for about a week. Then it makes a confident, plausible, wrong change to a record you were not watching, and you find it three weeks later in a document that has already gone to a family. The problem is not that the model is bad; it is that the mistake becomes invisible the moment it is written without review.
How staging works
Copilot actions that would change data are declared as tools with a strict schema. When the model calls one, the gateway validates the arguments and returns a staged action rather than executing it. Corra shows you what would change and what it would change from, and the write happens only on your approval — then it is recorded in an audit trail with the request that produced it.
- Read actions run freely; write actions always stage.
- You see a diff, not a summary of a diff.
- Approving is one action, and so is discarding.
- Every approved write is logged with its originating request.
Why not an auto-approve toggle
Because the person most likely to switch it on is the person with the least time to check what it did, and the setting would be a way of transferring responsibility to a teacher who never really consented to it. The friction is the feature. If a step is so routine that reviewing it feels absurd, that is an argument for making it a deterministic action rather than an AI one.
What this means for you
You are the professional in the loop and the product is built to keep you there. Corra drafts; you decide. Nothing reaches a student, a family or an official record without a teacher having read it — and if a draft is wrong, it is wrong in a review pane rather than in a document that has already been sent.
Common questions
- Does this make the copilot slower to use?
- Marginally, and deliberately. The review step is where errors get caught, and it is far cheaper than finding them after a document has left the building.
- Can I approve a batch at once?
- Batch review is supported for repetitive work such as a set of feedback drafts, but the reviewing is still yours — a batch approval is you saying you have read them.