Some approvals should stay human.
When every agent action needs a human yes, people turn into slow middleware, and someone proposes removing the approvals altogether. Both go wrong. Some gates, like moving money or making a promise you can't take back, should stay with a person.
Not every confirmation should be automated. Keep humans on money movement, irreversible customer promises, permission elevation, and similar red-line gates. Compare auto-ok actions against must-human approvals explicitly—then enforce the line in software.
Confirmation fatigue is not a strategy
If every agent action needs a human yes, people become slow middleware. The reaction is to remove the approvals. Both extremes fail.
Sort the actions. Some are safe to let through. Some must stay with a person, for a reason you can defend after an incident. Speed is not a reason to automate a gate you cannot undo.
What stays human by default
Treat these as human gates until you have a written reason to move one, and a way to move it back.
Money. Refunds, payouts, price overrides beyond a small bound, credit.
Promises you cannot walk back. A guaranteed date. A legal commitment. Language that waives, destroys, or grants exclusivity.
Permission. Roles, keys, exports, another tenant's records.
Identity. Merging accounts, changing ownership, changing who gets paid.
Holds. Releasing something under investigation, or overriding a stop your domain treats as compliance.
Words with weight. Admissions, regulated claims, public statements.
Bulk irreversible work. Mass cancels, mass messages, mass permission changes.
For each line, name the approver, the evidence they need, and whether the agent may prepare the action but not commit it. A list without roles is a poster. A list that the tool can ignore is a wish.
The agent should be allowed to draft, gather evidence, and recommend. That is often where it earns its keep. Commitment stays human until you have measured a reason to move a specific gate.
How the work moves
Prepare, gate, commit
- Prepare
Agent gathers evidence and drafts.
- Gate
Red-line check against checklist.
- Human decision
Approve, reject, or escalate.
- Commit
Tool runs only after attributed approval.
Speed is not a reason to automate a gate you cannot reverse.
Auto-ok versus must-human
Classify each action. Read and summarize can be automatic when the scope is allowed and the sources are shown. It cannot, when the sources include fields the agent should not see.
A draft reply can go out on its own only inside a template, with retrieved facts, and with no new promise. The moment the words commit you, a person owns it.
A schedule change inside policy, and reversible, can be automatic. Outside the window, or inside a contract, it cannot.
Refunds and permission changes do not get an automatic yes in this checklist. A retry of a failed job can be automatic only when you have proved it will not double the side effect.
If a row says automatic and you cannot explain why a repeat is safe, it is not automatic. If a row says human and the tool can still fire from the prompt, the gate is decoration.
Decision guide
Auto-ok vs must-human
| Consideration | Auto-ok | Must-human |
|---|---|---|
| Reversibility | Easy undo. | Hard or impossible undo. |
| Blast radius | Single low-impact record. | Money, access, or public promise. |
| Evidence | Complete and machine-checkable. | Requires judgment on incomplete facts. |
| Accountability | Ops accepts automated log. | Named person must own the call. |
Put the line where the action executes
A checkbox in a settings screen lies if the tool can still run. The agent may draft a refund. The refund tool should require a human approval with a name, a time, and a reason.
Machines assemble the context. People own the gates that have consequences. That is not slowness for its own sake. It is how the record stays attributable.
Re-read the line when the system changes
A new tool, a new model, a new market: read the list again. The first sign of drift is often an approval that became quiet.
Once a quarter, sit operations, risk, and engineering down with real incidents, not only the policy. If nobody can name the last time a gate fired, either you have no volume or the gate is being walked around.
Put this into practice
List what the agent can actually do. Mark the human gates. Remove ceremony on safe reads so people stop clicking through everything. Enforce the remaining lines in the tool that commits the action.
A good first delivery is often smaller autonomy with honest gates, not a wider agent with invisible authority. That product work sits under AI applications and agents.
Related work: Spin Market.
We build alongside the people doing the work.
Bring us the problem you’re thinking about.