Approval Gates: Designing Agents That Ask
The interesting question is not whether an agent should ask permission. It is which actions are worth a human’s attention, and how to spend that attention without exhausting it.
Reversibility is the axis that matters
Sort actions by how hard they are to undo, not by how important they feel. Reading is free. Writing a draft is nearly free — it can be deleted. Publishing is awkward but recoverable. Sending an email, charging a card and deleting a record are one-way doors.
Gate the one-way doors. Let everything else run. This single reordering usually removes most confirmation prompts without removing any real safety.
Show the diff, not the intention
“The agent would like to update your homepage” is not reviewable. “These 40 lines change, here is the before and after” is. The cost of a good approval screen is almost entirely in rendering the actual change; the yes/no button is trivial. Systems that skip this get rubber-stamped approvals, which is worse than no gate at all because it manufactures a false record of oversight.
Approve the exact operation, not the category
An approval should bind to a hash of the precise arguments. Otherwise you have approved a kind of action, and the thing that eventually runs may differ from what you read. Immutable arguments also make the audit trail meaningful afterwards: you can prove what was authorised, not merely that something was.
Give unattended mode a real switch
Some deployments genuinely have nobody at the keyboard — scheduled maintenance, bulk migration, overnight content runs. Blocking those on approval means the work does not happen. The right answer is an explicit operator choice with a different safety posture: no pause, but a durable record of everything that ran, and a snapshot taken before it started.
What matters is that the choice is deliberate and visible, not that the default is maximally cautious.
Expire pending requests
An approval that sits for three days should not still be executable. State drifts; the change that was safe on Monday may conflict with Wednesday’s. Short expiry windows keep the reviewed state and the actual state close together.
What to take away
Gate one-way doors, show real diffs, bind approval to exact arguments, and make unattended operation an explicit mode rather than an accident. Attention is the scarce resource — spend it where undo does not exist.