An agent can draft a refund, queue a delete, or post a message faster than a human can read the plan. Speed without a gate turns every tool into a production button. Most teams discover this after the first irreversible action, not before the design review.
Require human gates for high-impact agent tools. Let the agent prepare. Make a person confirm payments, destructive writes, and public posts. The gate is not distrust of models. It is respect for blast radius when tools are sharp.
Classify tools by irreversible impact
Build three bins: read, reversible write, irreversible write. Irreversible includes money movement, account deletion, public publishing, and credential rotation that locks others out. Only irreversible tools need a live human confirm by default in the runtime.
Tight tool schemas help the classifier stay honest. Bound names, args, and allowed hosts before agents call, as in bound tool schemas tightly before agents call them. Vague tools invite vague gates and quiet escapes.
Put the gate outside the model loop
The model can propose. The runtime must enforce. Approval should be a control-plane check, not a polite sentence in the system prompt. Prompts drift. Runtime checks do not if you version them like other contracts your team already reviews.
Keep agent secrets out of the session pack the model sees. Autofill or vault injection can happen after approval, which is the spirit of keep agent secrets out of live session context packs.
Log denials and approvals the same way
Every gate decision needs who, what tool, which args summary, and when. Structured traces make audits cheaper than screenshot archaeology. Teams that already log structured agent traces for cheaper debug work can add a gate field without inventing a second logging stack.
Egress allowlists still matter after approval. A confirmed tool should not suddenly reach hosts outside the sandbox policy covered in isolate sandbox egress before tool-calling agents roam.
Make retries respect the gate
A flaky network should not re-fire a payment because the agent retried. Cap retries by error class and require idempotency keys on irreversible tools. Pair gates with the discipline in cap agent retry budgets before loops melt your spend.
If the human walks away, expire the approval. Stale approvals are almost as dangerous as missing ones when overnight jobs wake up later.
Train operators on reject reasons
Publish short reject codes: wrong amount, wrong audience, incomplete plan. Agents learn from structured rejects faster than from a vague no. Weekly review which tools hit the gate most. Those are either high value or poorly scoped and need tighter schemas.
Start with one payment tool and one publish tool. Expand only after the gate path is boring in staging and the audit log is readable without a scavenger hunt.
FAQ
Which tools need a human gate?
Anything irreversible: payments, deletes, public posts, and credential changes that lock others out.
Can the model self-approve?
No. Approval must live in the runtime control plane, not only in prompt text.
What should an approval record include?
Actor, tool name, arg summary, timestamp, and expire time for stale approvals.
How do retries interact with gates?
Irreversible tools need idempotency keys and retry ceilings so a flaky call cannot double-fire.
Do read tools need gates?
Usually no. Focus gates on blast radius, not on every network hop.
Where should secrets enter the flow?
After approval, via vault or autofill, not inside the live model context pack.