Approval gates
Where a human must stand between AI and the world, how to build gates people can operate in five seconds, and how to keep review from decaying into rubber-stamping.
Everything so far organizes information — rows, tags, pings. Mistakes were cheap. The moment a workflow acts on the world — emails a customer, issues a refund, changes a record someone else relies on — the stakes change, and the design answer is the approval gate: the workflow prepares the action completely, then stops and waits for a human yes.
Where gates are non-negotiable
- External sends. Anything a customer, supplier, or the public will read. AI drafts; a human sends. This rule has no exceptions in your first year of automating — the day an ungated workflow says something wrong in your company's voice is the day all your automations get turned off.
- Money. Refunds, discounts, orders, payment reminders with amounts. Gate them. (A narrow standing exception — 'auto-approve under $25 on scanned return receipt' — is a policy decision made by a human in advance, written down, with a sampled audit. That's still human control; it just moved earlier.)
- Destructive or hard-to-reverse changes. Deleting records, closing tickets, updating the CRM field other teams key on. If undo is harder than approve, gate it.
Gate mechanics: make yes cheap, and no cheap too
Some platforms ship native approval steps; in others you assemble the gate yourself from a buttons message, a delay, and a 'pending' row a human flips — the pending-row version is fine for this course's lab. Either way, the construct matters less than the ergonomics: the approver must be able to decide in seconds, in the tool they already live in. The gate message carries everything needed to judge: what triggered it, what the AI concluded and why, the exact draft, and the buttons. If approving requires opening three tabs, the gate will be resented, then bypassed, then removed.
REFUND REPLY PENDING - ticket #482
from: dana@[customer].com | order HL-1042 | category: refund_request
AI urgency: normal | confidence: high
--- draft reply ---
Hi Dana - sorry the pour-over kit wasn't what you hoped for. We'd
like to ship a replacement tomorrow, or refund you in full once we
confirm the return - just reply with your pick. -Harbor Lane Support
-------------------
[APPROVE & SEND] [EDIT IN TRACKER] [REJECT]
timeout: 4h -> remind; 8h -> escalate to ops channel- Design the timeout. An unanswered gate can't block forever: after N hours, remind, escalate to a second approver, or safe-default (usually 'don't send, flag it'). Decide at build time — the day the approver is on a plane is not the day to improvise.
- Log every decision. Who approved what, when, and the draft as sent. Boring until the day it's the only thing that matters. Platforms log runs already; make sure the approval is in the run record.
- Watch the approval rate. If a gate runs at ~100% approval for a month, either the AI has earned a narrower gate (move the threshold, keep sampling) or the reviewer has stopped reading (fix the message, rotate the duty). A gate nobody really operates is worse than no gate — it produces confidence instead of control. The AI Foundations course names this decay: automation complacency — and a gate running at 100% approval is exactly where it breeds.