Add a human approval gate

Mental model: the model proposes; infrastructure authorizes. A gate is a persisted state transition—proposed, approved, rejected, expired—not a modal dialog. Use it when an action is external, irreversible, financially consequential, permission-expanding, or regulated.

Mechanism: proposal → policy → revalidated action

Procedure

1. Inventory actions and classify blast radius, reversibility, target, and authority.
2. Define auto-run, sampled-audit, and approval tiers with a policy owner.
3. Persist the proposal before notification: tool, arguments, evidence, policy, version, expiry, and idempotency key.
4. Show a reviewer intent, target, diff, evidence, risk, and undo/appeal path.
5. On approval, revalidate state and execute once; on rejection, append the reason to the agent trace.
6. Measure approval latency, overrides, stale decisions, incidents, and reviewer workload.

proposal = {"status":"pending", "amount":84, "order_version":3}
def approve(p, current_version):
    if p["order_version"] != current_version: return "reject: stale proposal"
    p["status"] = "approved"; return "execute once"
print(approve(proposal, 4))

Run with python3; expected output is reject: stale proposal. The executor, not the model, owns that check.

Definition of done

Over-gating reversible actions creates fatigue; under-gating high-impact actions creates unbounded blast radius. Promote an action only after holdout evals and sampled audits demonstrate it clears safety and quality thresholds.

Failure modes

Reject stale proposals, duplicate execution, missing evidence, and any route that bypasses the same authorization policy. A reviewer without time, authority, or a rejection reason is not meaningful oversight.

Exercises

1. Add expiry and a duplicate-execution test to the artifact.
2. Classify five product tools and justify one sampled-audit tier.

Connects to: guardrails · least privilege · oversight

Sources

• OWASP LLM06: Excessive Agency — action-authority risks.
• NIST AI RMF — governance controls.
• OpenAI: A Practical Guide to Building Agents — layered guardrails.