The more work you hand to an AI agent, the more "actions you would not want it to take alone" you get:
- Sending an email
- Making a payment
- Deleting data
- Publishing something externally
Letting an agent run these end-to-end on its own judgment is risky. But checking everything defeats the point of automation.
The pattern that resolves this is an approval gate.
What an approval gate is
An approval gate inserts a human decision right before a dangerous action executes:
- The agent prepares the action (a draft, a payload, a plan).
- If the action is classified as dangerous, it stops instead of executing.
- A human reviews the exact content; only after approval does it run.
The key is selectivity: don't gate everything. Reads, drafts, and summaries — anything you can undo — flow through untouched.
What counts as "dangerous"
Use one test: can this be undone?
| Action | Undoable? | Gate? |
|---|---|---|
| Create a draft | Yes (delete it) | No |
| Research / summarize | Yes | No |
| Send an email | No (it reaches someone) | Yes |
| Charge a payment | No | Yes |
| Delete data | Usually no | Yes |
| Publish externally | No (it gets seen) | Yes |
Details vary by domain, but "reaches another person", "moves money", and "makes something disappear" covers most of it.
The common failure: rubber-stamp approvals
Gates fail quietly when approval becomes a reflex — a button you click without reading.
Two fixes:
- Show what, to whom, and how much on a single screen at approval time.
- Keep an approval log: who approved what, and when. When something goes wrong, the log tells you where the judgment drifted.
It works as a set
Approval gates protect the human-judgment side. Pair them with the machine-side brakes:
- Idempotency keys — the same instruction never executes twice (a numbered-ticket system).
- Circuit breakers — hard caps on count, amount, and time; the agent stops itself.
- Outbox pattern — hold before sending, so mistakes can be caught in the gap.
Summary
- Gate the irreversible actions, not everything.
- Decide with one test: can it be undone?
- Make approvals readable, and log them.
- Design the brakes together with the engine.
The wider the scope you give an agent, the more the stopping mechanisms matter. Deciding how it stops first is what makes it safe to let go.
Related
- Free guardrails tool for AI agents (safe-agent-mcp): https://github.com/naoanao/safe-agent-mcp
- Live demo: https://naoanao.github.io/safe-agent-mcp/
Top comments (0)