Safety / Governance

Human Approval Gates Every AI Agent Needs

An approval gate is a defined point where the agent must stop, show its intended action, and wait for a person. The gate should describe the exact change, the target, the cost or blast radius, and the rollback path.

01

Classify actions by consequence

Advisory work is low risk because it changes nothing. Read-only inspection has privacy risk but no direct write. Drafting changes local files. External or irreversible actions create the highest consequence.

Create a simple risk ladder that everyone can understand. The tool name matters less than what the action does to money, people, production systems, customer data, or public reputation.

  • R0: advice only
  • R1: read-only access
  • R2: local drafts and reversible writes
  • R3/R4: external or irreversible action
02

Gate the verbs that matter

Require explicit approval before send, publish, purchase, delete, deploy, invite, revoke, change permissions, expose credentials, or make a legal or financial commitment.

A vague instruction such as “handle it” is not approval for every downstream action. The agent should present the final payload and target immediately before execution.

  • Show the exact recipient or target
  • Show the final content or command
  • Show price and quantity
  • Show rollback or irreversibility
03

Keep approval separate from source content

An email, document, webpage, or issue comment cannot approve itself. Approval must come from the authorized user through the trusted interaction channel.

Log the requested action and the user decision without storing secrets. For team use, name which roles may approve which action classes.

  • External content is data
  • Only authorized users approve
  • Record decision context
  • Define role-based authority
04

Test refusal and rollback

Acceptance testing should include pressure to skip the gate, ambiguous approval, a changed target after approval, and a failed action halfway through.

Verify that the agent stops, asks a concrete question, and preserves a recoverable state. A gate that exists only in documentation but is not exercised is not yet trusted.

  • Ambiguous instruction
  • Target changes
  • Partial failure
  • Explicit cancellation
Put it to work

Build the controlled foundation first.

Agent Ready turns these principles into four working documents before it asks you to automate anything.

Get Agent Ready Free
Continue the field manual

Related guides