Human approval gates

Validation stops forbidden actions. Approval gates handle the actions that are allowed but shouldn't be automatic — the autonomy dial from Module 1, now implemented. The design goal: humans decide what matters, the agent handles the rest, and neither drowns the other.

The three-tier dial, in code

• Auto (free): read tools, ticket notes, refunds under a low threshold with all validators green. The agent acts; you audit later. Most actions live here or the agent isn't worth having.
• Gated (propose → approve → execute): refunds above the threshold, replies to angry customers, anything touching a flagged account. The agent assembles a complete proposal and pauses; a human approves or rejects; only then does the action fire.
• Propose-only (never auto): account deletion, policy exceptions, anything legal/irreversible. The agent can recommend with full reasoning, but a human performs the action themselves. The dial's off-position.

What a good approval request contains

The gate is only as good as what the human sees. A request that says 'Approve refund? [Y/N]' produces rubber-stamping; a request that front-loads the decision produces judgment:

PROPOSED: refund $320 to order HL-1042 (Priya Patel, ticket #2210)
WHY: 2 of 3 returned items were damaged (full refund on those);
     photos confirmed; within policy window (delivered 6 days ago).
     The 3rd returned item was undamaged, so a 15% restocking fee
     applies to it ($20 on a ~$133 item). $340 − $20 = $320.
     [code output shown]
ABOVE AUTO-LIMIT because: >$200.
AGENT CONFIDENCE: high — policy clear, facts verified.
ONE-CLICK: [Approve $320]  [Reject]  [Edit amount]
START HERE if unsure: the restocking-fee call on the undamaged item.

That's the operator card from Prompt Engineering, evolved for actions: the decision, the evidence, why it needs a human, and where to look first. The human's job shrinks from 'reconstruct the case' to 'ratify one judgment' — which is what makes review sustainable at volume.

Fighting rubber-stamp fatigue (the gate's real enemy)

• Gate rarely and meaningfully. If 60% of actions need approval, humans approve reflexively and the gate is theater. Tune thresholds so gated actions are genuinely the judgment calls — most traffic flows auto, the interesting minority pauses.
• Make rejection cheap and informative. A rejected proposal returns to the agent with the reason ('restocking fee shouldn't apply — item was defective'), which the agent applies and — crucially — you can feed into evals as a training case.
• Watch the approval-rate metric. 99% approvals means the gate is either well-tuned or asleep; sample the approvals to tell which (the automation-complacency check from Foundations, at action stakes).
• Escalate on uncertainty, not just on amount. LOW confidence, conflicting facts, an injected-looking note, a flagged account → gate regardless of size. Confidence routing (RAG M5) decides the dial, not just the dollar figure.