Outflow Build Log: Designing Human Approval Boundaries for Autonomous Agents

First-hand engineering lessons from deploying Outflow as an internal proving ground for Geolify outbound motion.

The Initial Failure Mode: Full Autonomy

When we first deployed Outflow to handle outbound research for Geolify, we tested a fully automated loop: signal detection → email generation → dispatch.

The outcome was instructive. The generated context was technically accurate, but edge cases in brand tone and prospect seniority slipped through — small errors in absolute terms, corrosive in aggregate. The deeper problem was not accuracy; it was disconnection. The team could no longer answer a basic operational question — what did we send, to whom, and why — without reconstructing it after the fact. An autonomous system without a visible control plane creates operational anxiety even when it is performing correctly.

The Solution: The Reviewable Brief

We redesigned the entire system around a single artifact: the Reviewable Brief.

• Outflow monitors external signals (job postings, funding events, search-visibility shifts).
• Outflow synthesizes a short brief explaining why this account is relevant now — the reasoning made explicit, not implied.
• The operator receives an action card with three options: Approve, Edit Context, or Reject with Feedback.

Two design properties matter more than the workflow shape:

• The gate is load-bearing, not advisory. Nothing dispatches without an operator action. There is no timeout-auto-approve path, because a gate that can expire under load is a gate that fails exactly when it is needed.
• The brief carries the reasoning, not just the output. An operator asked to approve a message they cannot quickly understand will either slow to a crawl or rubber-stamp. The brief exists so the human decision is informed and fast — the three options map to the three real judgments (yes / not like this / not at all, and here's why).

Reject with Feedback earns its place specifically: a rejection that returns signal to the system turns the review loop into a training loop for the operator's intent — the boundary gets sharper with use rather than merely holding.

Why the Boundary Is an Interface Problem

The tempting frame for human-in-the-loop is policy: "a human approves consequential actions." The build log says otherwise. Policy declares intent; the interface determines whether the intent survives contact with a real workday. Every property that makes the gate effective is an interface property — the brief is short enough to actually be read, the options map to real judgments, and the gate cannot be routed around. Where the interface fails, the policy fails silently: review degrades into skimming, then into reflexive approval, then into a control that exists on the architecture diagram and nowhere else.

What the Experiment Does and Does Not Prove

The honest scope: Outflow is an operational experiment, and the build log records design decisions and their reasoning — not performance claims. What the work demonstrates is that an explicit approval boundary is buildable without collapsing throughput, and that operators engage more deeply with a system whose actions they can inspect and veto. Whether the gated model produces durably better deal outcomes is a question the evidence is still accruing — and per the studio's own discipline, we report the boundary where the evidence currently stops.