RFC: Human Gates for Consequential Agent Actions

An open proposal: consequential actions by autonomous agents should carry an explicit human approval surface as an industry norm. This RFC specifies what the gate must guarantee and invites comment.

Status of This Document

This is a request for comments: an open proposal, not a product announcement. It is informed by the studio's work on Outflow — an Operational Experiment in autonomous outbound, structured as Observe → Research → Act → Learn with a human gate on Act — but the proposal itself is general. Nothing here claims the norm is adopted. It argues the norm should exist, and states the properties a gate must have to be real rather than decorative.

The Problem

Agentic systems increasingly act rather than answer. They send messages in a principal's name, commit spend, change production state, publish artifacts. The industry norm for these actions is forming now, while the systems are young, and it will harden into tooling, procurement checklists, and eventually regulation.

The default norm emerging is autonomy-first: the agent acts, and review, where it exists, is a log read after the fact. That norm optimizes for the demo rather than the deployment. An action that cannot be un-sent, un-spent, or un-published is governed, under the autonomy-first model, by whatever the agent happened to decide. This RFC proposes that the default points the wrong way for a specific class of actions.

Definitions

For the purposes of this proposal:

• Consequential action: an action whose effects are hard to reverse and that binds a real person or organization: dispatched communication, committed funds, published content, mutations to shared or production state.
• Human gate: an explicit approval surface through which a consequential action must pass before it executes.
• Advisory review: any review that happens after execution, or that execution can proceed without. Advisory review is not a gate.

The line this RFC draws is not "humans approve everything." Reversible, low-stakes actions (research, drafting, classification, scheduling within constraints) need no gate and gain nothing from one. The claim is narrower: consequential actions need gates, and gates need guarantees.

What the Gate Must Guarantee

A gate is real only if it carries all of the following. A gate missing any one of them is, in the failure mode that matters, no gate at all:

• Load-bearing. Nothing executes without an affirmative human action. No timeout-approval path exists, because a gate that expires under load fails exactly when the load is highest.
• Informed. The gate presents the reasoning, not just the output: why this action, why this target, why now. An operator asked to approve what they cannot quickly understand will stall or rubber-stamp; both outcomes void the guarantee.
• Cheap to use, hard to bypass. The human decision must be fast enough that the honest path is also the easy path. A gate that costs minutes per item gets batch-approved into theatre; a gate that can be skipped gets skipped under deadline.
• Legible options. The options map to real judgments (approve, edit, reject with reason), not to a single confirm button. A rejection that returns signal turns the review loop into a training loop for the principal's intent.
• Auditable. A record exists of what was proposed, what was decided, by whom, and what executed. The gate stays accountable to reality only if the record survives the action.

These are interface properties, not policy statements. Declaring "a human approves consequential actions" in a policy document guarantees none of them; the interface either enforces the guarantee or silently does not.

What the Gate Does Not Claim

The gate is not a correctness guarantee, and it is no substitute for capability. A human can approve a bad action; the gate ensures only that a named person was accountable for the decision at the moment it mattered. Nor does this RFC claim proportionality is solved. Which actions count as consequential is a live question, and the line will move as agents become more reliable.

Open questions left for comment:

• How should consequentiality thresholds be set, and by whom — the operator, the platform, or the counterparty?
• What happens to gates in multi-agent systems, where the agent proposing an action differs from the agent executing it?
• Should gate records be portable — auditable by parties other than the operator who approved?

The studio's operating code is automate execution, not responsibility; the shorthand for this RFC's claim: machines hold the repetition, people hold the stakes. Comments, counterproposals, and failure reports are invited; this norm is worth getting right while it is still being written.