Approval gating
Approval gating is the operational pattern where consequential agent actions queue with a one-line summary and require explicit user authorization before firing. Routine actions execute freely; gating bounds the blast radius of misunderstood instructions.
Why it matters
Autonomous agents that act on real accounts have a tradeoff between speed and safety. Run everything through manual approval and the agent loses most of its value (the user is back to operating each step). Skip approval entirely and the agent's worst-case error becomes "the production database wiped" or "an invoice sent to the wrong customer for the wrong amount."
Approval gating is the calibrated middle. Routine actions (sending a text message, looking up a record, checking the calendar) execute immediately. Consequential actions (moving money, posting publicly, sending mass communications) queue with a summary and wait for authorization. The user reviews the queue with morning coffee; replies "do 1, skip 2, edit 3"; the queued actions fire or do not.
The pattern works because most agent activity is routine. The minority of consequential actions per day fits into a one-glance morning review. The user spends seconds approving instead of minutes operating, while still seeing what the agent is about to do before it happens.
The 2026 industry shift was from "raw capability" to "bounded capability with approval gating" as the framing for what users want from agents. The publicly-documented incidents (the OpenClaw production-database wipe) accelerated that shift.
How Ajeris handles this
Each tool the agent can call has a configurable approval policy. Routine tools execute immediately. Consequential tools queue. The user sees the queue as a one-line message: "I want to send the invoice to Mary for $480; reply do 1 to confirm." Reply "do 1" or "skip 1" or "edit 1 to $580."
Defaults are conservative. Approval-gating loosens as users build trust with the agent on specific patterns; "always send invoices to customers I have invoiced before" is a configurable rule that auto-approves matching cases.
The queued actions write to the audit trail when authorized or rejected, so review is possible after the fact.
