Track 03 · Agents & toolsLesson 08 of 12
Approval gates and bounded autonomy
Grant autonomy step by step, with people approving the actions that matter.
- The FDE path · Stage 4 of 6
- 40 min read
- 60 min hands-on
- Pro
What you'll be able to do
01- Choose a human-in-the-loop pattern (approve, edit then approve, reject with feedback, ask for input) for each action an agent can take.
- Classify actions into risk tiers and write a gate policy with limits on value, volume, scope, time and recipients.
- Design an approval request a reviewer can judge, with escalation, expiry and fail-closed behaviour.
- Implement an action gate that auto-executes low-risk actions, queues the rest bound to a content hash, handles approve, edit, reject and expire, and writes an audit trail.
- Defend promoting or demoting an action on the L0–L5 ladder with evidence, and detect rubber-stamping before a model-risk reviewer does.
Before you start
- Agent or workflow? Choosing the autonomy level: the L0–L5 ladder this concept moves actions along.
- Tools with scoped, auditable access: scopes, parameter constraints and approval binding at the tool.
- The agent loop, written by hand: a gate is a pause in the loop with a named stop reason.
- Typed output: schemas, validation and tool calls: a proposal is a typed object.
- Workflows that survive restarts comes after this concept in the README order; its update-with-validator section makes the approval wait survive restarts.
The short version
An approval gate is a deterministic checkpoint between an agent's proposal and its execution. Policy code, not the model, classifies each action by risk. Reads run. Reversible internal writes run within limits. External or hard-to-reverse actions wait for a human, who can approve, edit then approve, reject with feedback, or answer a question. Consequential decisions in regulated work are not agent actions at all. Approvals bind to the exact content shown, are single use, expire, and leave a record of who approved what, when and on what evidence. Autonomy is then granted per action class and segment: when approval history shows, with a confidence bound and with proof that reviewers were paying attention, that humans almost never change a class of proposal, it can move from L4 (gated) to L5 (policy-bounded) inside an envelope of limits. Any incident moves it back.
Key takeaways:
- Tier is set by policy on the tool and its arguments, never by the model's self-assessment.
- The envelope bounds what the agent may do without a human. Outside it, the action drops back to L4.
- Reviewers need the exact artefact, the evidence and the consequence. The approval screen is part of the control.
- Promotion is slow, evidence-based and signed. Demotion is fast and automatic.
- An approval rate near 100% means a good agent or a broken gate. Seeded test cases tell you which.
Pro lesson
The rest of this lesson is in Pro.
The mental model, worked example, field note, failure table, exercise and self-check, with the voice tutor.
Pro opens this stage
Stage 4 · Agents that act safely- 7 lessons, with the voice tutor
- Lab · Find the intake agent's failed writes, graded here
Also in Pro
- Every stage and specialisation, in full
- Every lab and every role project
- Halden weeks 2–10, on your record
- Every drill, live in the playground
- All solutions, plus the server judge
- Lab Assistant and every Teach with AI