Agents That Wait: Interface Design for Approval Gates
A human approval gate is only real if the interface makes review cheap to perform and structurally impossible to bypass — anything weaker degrades into batch approval and theatre.
Autonomous agents earn trust at the approval boundary. The interface rules that keep a human gate load-bearing: briefs that carry the reasoning, options that map to real judgments, and no dispatch path that skips review.
The Gate Is Where the Safety Property Lives
Outflow runs a four-stage loop — Observe, Research, Act, Learn — with one hard constraint: Act is human-gated. Consequential actions wait for explicit approval. Nothing dispatches on a timer, nothing sends because a queue got long, and no code path reaches the outside world without an operator's decision in front of it.
That constraint is a policy sentence. Whether it survives a real workday is an interface question. A gate that is expensive to use will be routed around; a gate that can be bypassed will be, under deadline pressure, every time. The safety property of the system lives in the approval surface itself — which makes interface design the load-bearing discipline, not a styling exercise.
Cheap to Use
The first failure mode of a human gate is cost. If reviewing a proposed action takes minutes of reconstruction — opening the research, checking the account, understanding why the agent chose this moment — operators do what overloaded reviewers always do: they skim, then they rubber-stamp. Review latency is not a convenience. It is the variable that decides whether review happens at all.
The design response in Outflow is the reviewable brief. Before an action reaches the gate, the agent has already done the legible part of the work: why this account, why now, what evidence supports contact, what it proposes to say. The brief carries the reasoning, not just the output — context before contact, evidence before action. The operator's remaining job is the judgment only a person can make: whether this action should exist.
The options map to the three real judgments: approve it, edit the context, or reject it with feedback. Three options because there are three real outcomes — yes, not like this, and no. A single approve button would collapse "not like this" into either a bad send or a silent discard, and both lose information the system needs.
Hard to Bypass
The second failure mode is structural: paths around the gate. These are rarely malicious. They accumulate as conveniences — a batch-approve for clearing a backlog, an auto-approve for "low-risk" items, a timeout that releases stalled approvals. Each is defensible in isolation. Together they turn the gate into a suggestion.
Batch approval deserves specific attention because it is the most tempting shortcut and the most corrosive. Approving ten briefs at once is not review; it is a signature on a stack of unread paper. The interface treats it that way: review happens per action, because the judgment is per action. Under load, the correct behavior is a queue that waits, not a gate that opens. An agent that waits is the design working. An agent that ships under pressure is the gate failing exactly when it is needed.
The division of labor holds the boundary: unattended work where the pattern repeats, human judgment where the consequence is real. Monitoring, research, and brief assembly run unattended. Dispatch waits for a person.
The Feedback Half of the Loop
A gate that only blocks is half a gate. Every operator decision is also a signal about the system's judgment — which is what the Learn stage consumes:
- Approvals confirm the reasoning chain was sound.
- Edits show the delta between machine judgment and operator judgment — the most information-dense signal the loop produces.
- Rejections with feedback teach the boundary directly: not just that the action was wrong, but why.
A rejection with a reason attached teaches the gate where its boundary actually runs — it gets more accurate about what needs review and how briefs should be argued, improving with use rather than merely holding.
The Rules That Keep the Gate Real
The interface rules, stated plainly:
- Review is per action. No batch paths.
- The brief is short enough to actually be read.
- Options map to real judgments, not to the database schema.
- There is no auto-approve, on timeout or otherwise.
- People before promises: nothing consequential reaches the outside world unsigned.
A gate designed this way is the product surface, not a checkbox on an architecture diagram. The agent's autonomy is credible precisely because the boundary is — and the boundary stays credible because the interface makes the human decision fast, informed, and unavoidable.