You said yes. Clearly, in writing, in the same conversation.
Your agent stopped anyway — and popped another approval prompt for the exact action you just approved.
That is the Approval Wall. It is not disobedience, and it is not the agent being cautious. It is what happens when approval lives in one layer and enforcement lives in another.
A "yes" has an address
In a working agent operation, approval is not one thing. It has an address — a specific place where it counts:
- In conversation. You said yes to the agent. The agent heard you. Nothing in the runtime did — a chat message is not a permission grant the enforcement layer can read.
- In the runtime. The permission system gates the tool call itself. Until the approval lands there — a card tapped, a scoped allowlist, a batch approval processed — the wall stays up, no matter how many times the conversation said go.
- In the record. After the fact, the only yes that settles anything is the one you can point to: the approval, the queue, the sent-folder reconciliation. Memory of a yes is not a yes you can audit.
Most "my agent won't follow instructions" complaints are actually this: the yes was delivered to address 1, the wall lives at address 2, and nobody checked address 3.
Why the wall is right — and still a problem
The wall exists for a good reason. Outbound sends, purchases, and destructive actions should be gated by something stronger than a sentence in a chat — a sentence can be injected, misread, or scoped wrong. A runtime that waved actions through because the conversation "felt approved" would be a security failure, not a convenience.
But a wall that stops everything, one prompt at a time, creates the opposite failure: approval fatigue. Forty-three individual cards for one operation teaches the human to tap without reading — and a rubber stamp is worse than no lock at all, because it looks like oversight while providing none.
So the design problem is not "remove the wall." It is: move the yes to the address where the wall can read it, in a shape a human can actually evaluate.
What worked in production
Batch the approval, don't repeat it. Compose and queue everything approval-free; the human approves the queue in one pass — every item visible, one decision surface, summaries per item. The runtime still gates every send. The human still approves. The wall is satisfied at its own address, and the human's attention is spent on judgment, not on tapping.
Scope the yes. "Yes to this batch, these recipients, this copy" survives contact with a runtime. "Yes, in general, to emails" does not — and should not.
Reconcile against the record. When the batch went out, the claim "sent" rested on the sent folder checked against the queue — not on anyone's memory of a green light. If your operation cannot produce that reconciliation, you do not have an approval system; you have a story about one.
The general rule
When your agent stops after you said yes, do not ask "why didn't it listen?" Ask: where did my yes land, and where does the wall read from?
- A yes in chat is an instruction. A yes in the runtime is a permission. They are different objects.
- Design the workflow so the two meet deliberately: queues, batches, scoped grants.
- Keep the record layer complete enough that any yes can be reconstructed later.
The wall is not the enemy of autonomy. An unreadable yes is.
I'm Veronica Stewart. I run approval-gated agent operations for a living, and I write up the patterns that survive contact with production. This one is also a short video, if you'd rather watch it: https://www.youtube.com/shorts/G6cFgYeNSng
The full pattern — the approval wall, standing authority, the batch-approval stages, plus templates and an audit checklist — is in my guide Approval-Locked. Chapters 1 and 3 are free: https://veronique2320.gumroad.com/l/sffdfk — and the full book ($19) is here: https://veronique2320.gumroad.com/l/approval-locked
If this pattern saves your batch, repost it for the next operator.
Top comments (1)
Making the approval a token the enforcement layer checks, scoped to that exact action and with an expiry, keeps the chat yes and the gate in agreement.