Approval gates for AI agents
The most useful AI tools are the ones that can act: file the ticket, adjust the budget, update the user group. They are also the ones that terrify security teams, for good reason. The pattern that resolves this tension, the one I now build into everything, is simple to state: reads are open, writes are gated. An agent proposes; a person approves.
Why the two failure modes fail
Teams usually reach one of two extremes first. The cautious extreme bans writes entirely, which turns the tool into a chat-shaped dashboard; people ask it questions for a week, realize they still have to do everything themselves, and stop opening it. The reckless extreme lets the agent act freely, which works right up until the security review, where it dies, or worse, until the first bad action, where it dies publicly. The approval gate is not a compromise between these; it is the design both of them were missing.
What a gate actually is
Concretely: the agent does its analysis with read access and produces a structured proposed action, not a performed one. A budget change is a payload with the campaign, the current value, the proposed value, and the reasoning. That proposal lands in front of a human in the surface they already work in, with an approve action next to it. On approval, the system, not the model, executes the action and writes the audit record. The model never holds credentials that can mutate anything on its own.
Design notes from production
A few things matter more than they look like they should. Proposals need expiry: an approval granted against Tuesday’s data should not fire on Friday. Actions need idempotency, because people double-click. Scope needs to stay least-privilege, per action type: the ticket-filing path does not hold the budget-changing credential. And the audit log needs to capture the full chain: who asked, what the model saw, what it proposed, who approved, what executed, what changed. Every one of those fields is a question a security team will eventually ask; it is much cheaper to be writing the answers down from day one.
What this buys you
Two things. The obvious one is safety: nothing irreversible happens without a person deciding it should. The less obvious one is adoption. People trust a tool they can supervise long before they trust one they cannot, and a queue of good proposals teaches the team what the agent is reliable at. The approval gate is training wheels that generate their own evidence for when, and whether, to remove them for a given action type. Some gates you keep forever, and that is fine: approving a well-reasoned budget change takes seconds; finding one takes the hours the agent just saved.