FG-0213 Approval Gate Architecture
Description
A structured human-in-the-loop (HITL) approval mechanism for autonomous agent actions. Before an agent executes any action, it displays what it intends to do, provides a risk assessment, and waits for human approval. The architecture supports trust graduation: start with full approval for every action, then graduate to auto-approve for low-risk actions as the agent proves reliability. The gate is human-in-the-loop oversight scaled by accumulated trust.
Implementation
Build approval into the agent execution loop. Each proposed action gets: a clear description, risk level, expected outcome, and Y/N/skip controls. For destructive or irreversible actions, require explicit approval regardless of trust level. Track approval history. After N successful approvals in a category, offer auto-approve for that category. Build safety checks into the gate itself: block patterns like rm -rf, scope violations, or unauthorized network access before they reach the human.
Success Indicators
- Every agent action passes through the gate before execution
- Trust graduation is measurable: auto-approve categories grow as reliability is demonstrated
- Zero unapproved destructive actions reach execution
- The approval UX is fast enough that it does not become a bottleneck for trusted action categories
Failure Modes
- Approval fatigue: too many low-risk approvals cause the human to rubber-stamp without reading
- Gate too permissive: auto-approving categories before sufficient evidence of reliability
- Missing the gate entirely: agent pathways that bypass approval due to implementation gaps
- Risk assessment inaccuracy: labeling high-risk actions as low-risk, defeating the purpose
Sub-Methods 3
Define how proposed actions are displayed to the human. Include syntax-highlighted code for script execution, network targets for scan actions, and file paths for write operations. The display must make the action's impact immediately clear without requiring the human to parse raw commands.
Define the thresholds for graduating from full approval to auto-approve. Track approvals by action category. After a defined number of consecutive successful approvals (no rejections, no incidents), offer auto-approve for that category. Any rejection resets the counter. The ladder makes trust accumulation visible and reversible.
Build pattern-matching safety checks into the gate itself. Block known-dangerous patterns (recursive delete, scope violations, credential exposure) before they reach the human for approval. The safety layer catches the obvious threats so human attention can focus on the subtle ones.