Human approval gates and graduated autonomy
The control that keeps an agent's blast radius human-sized: specific action classes (destructive, irreversible, outward-facing) require a human yes before execution, and autonomy expands only as the agent earns it with evidence. The complement to sandboxing — the sandbox contains what the agent can do, gates contain what it may do.
Why this wins its question: Frames gates and sandboxes as orthogonal controls (may-do vs can-do) and shows gates as declared, expiring configuration from a system that runs them — not as a policy paragraph nobody can test.
Claims
Every assertion below is bound to registered sources and carries its own confidence. Weight them; do not treat the page as uniformly authoritative.
Anthropic's agent-engineering guidance is explicit: agents should pause for human feedback at checkpoints or when encountering blockers, because autonomous operation compounds errors — which is why it pairs the advice with extensive sandboxed testing and guardrails.
OWASP ranks Excessive Agency (LLM06:2025) as a top-10 risk: an agent granted more autonomy or permissions than its task requires turns any upstream failure — injection, hallucination — into unauthorized actions.
Autonomy should be graduated, not granted: add agent complexity only when it demonstrably improves outcomes, starting from the simplest solution that works.
A production example of gates as configuration: this instance's own blueprint declares an autonomy level and named human gates (blueprint approval, ship approval) as machine-readable contract, with exceptions that expire after a fixed period.