On the way to Saturn, Cooper asks TARS about his settings. Honesty: 90 percent. Why not 100? Because, the robot explains, absolute honesty is not always the safest form of communication with emotional beings.
Everything about that exchange is doing work. The most capable machine in Interstellar runs on dials. Honesty 90 percent. Humor 75, dialed down to 60 after a self-destruct joke lands badly. A trust setting Cooper can query out loud, mid-mission. TARS flies the ship, runs the docking, handles the data, and nobody looks over his shoulder for any of it. But for anything consequential he defers to the crew, and the autonomy he does have was configured deliberately, per situation, by the people responsible for the mission. Everyone on board knows the current values.
Notice what the crew never does: flip a single switch labeled "trust the robot."
Every team deploying AI agents right now is setting those dials, whether they realize it or not. The industry's standard answer is "human in the loop": the AI proposes, a person approves. Good answer. But most teams stop at putting a human in the loop and never ask the harder question: what makes the human stay real?
How Gates Decay
An approval gate on day one is a genuine review. Someone reads the AI's proposed action, thinks about it, and decides.
An approval gate on day ninety is usually a click.
The decay is mechanical, and it comes from a fact that sounds like good news: the AI is right most of the time. When a reviewer approves 200 proposals in a row and every one was fine, proposal 201 does not get read. It gets approved. Security teams have a name for this from a decade of alert fatigue, and the outcome is always the same: the control exists on the flowchart and nowhere else.
The dangerous part is that a decayed gate is worse than no gate. It still generates the paper trail of oversight. When something goes wrong, the log shows a human approved it, so the incident review blames the human instead of the system that trained them to click. And in the meantime, the gate's existence justified giving the AI more powerful capabilities than anyone would have granted it unattended.
A rubber stamp is not a weak control. It is a false one.
Gate on Risk, Not on Everything
The first design decision is what needs a gate at all, and the correct answer is: less than you think, guarded harder than you planned.
Gating every AI action feels safe and guarantees decay. If the reviewer sees 500 trivial proposals a day, their attention is spent long before the one that matters arrives. Review attention is a budget. Spend it where the blast radius is.
A workable split has three tiers.
Auto-execute with logging: reversible, internal, low-value actions. Drafting content nobody has seen yet, querying data read-only, creating tickets. If it goes wrong, you undo it.
Gate: irreversible or externally visible actions. Writing to production data, sending anything to a customer, committing code, spending money. This tier should be small enough that each review gets real attention.
Forbid: actions the agent cannot take regardless of approvals. Credential access, permission changes, deleting backups. No gate, because no proposal should exist. These belong to guardrails, which we covered in the harness engineering post.
If your gated tier is receiving hundreds of items a day, you have not built an approval gate. You have built a queue that manufactures liability.
Show the Diff, Not the Summary
What the reviewer sees determines what the review is worth.
A surprising number of HITL designs show the reviewer an AI-written summary of the AI's own proposed action. "This change updates campaign categorization for Q3 records." Approve? The review is circular. The same system that might be wrong is describing itself to the person checking whether it is wrong.
Show the artifact. For a data change, the actual diff: rows before, rows after. For an outbound email, the full text and the recipient list. For code, the commit. For a payment, amount, destination, and what triggered it.
We built JESTR's correction workflow on this rule. When the agent proposes a data fix, the admin sees the literal SQL diff that will be committed, not a description of it. The approval means "I read this change," not "I trust the machine's summary of itself." That distinction is the entire value of the gate.
Two smaller design choices compound this. Make rejection as easy as approval, with a reason field that feeds back into improving the system; if rejecting requires three screens and approving takes one click, you have engineered the rubber stamp. And keep review items in small batches. A reviewer facing a wall of 80 pending items will process them like a wall, not like 80 decisions.
Measure the Gate or Lose It
Approval gates need monitoring the same way servers do, and the metrics are cheap.
Approval rate. If it is sitting at 99-100%, one of two things is true: the AI has earned auto-execution for that action class, or the review is dead. Both are worth knowing. Move the reliably-safe categories to the auto-execute tier and keep the gate for what still fails.
Time per review. Three-second approvals on multi-line data changes are not reviews.
Canaries, if the stakes justify them. Inject a known-bad proposal occasionally and see whether it gets caught. Security teams phish their own employees for the same reason. It is not about gotchas; it is the only direct measurement of whether the control still exists.
And when reviewers do catch something, treat it as gold. Every rejection is a labeled example of the AI's failure modes, which is precisely the data that improves prompts, sensors, and guardrails. A gate that feeds nothing back upstream is paying for judgment and discarding it. Over time, the goal is not a busier gate. It is a system that needs the gate less, for reasons you can prove.
Autonomy done well is a set of dials: visible, deliberate, adjusted as the stakes change. An unexamined approval gate is the opposite: a switch someone flipped to "trusted" months ago that nobody has looked at since. If you are shipping agents this quarter, audit your gates before you scale the agents. Count the approval rate. Time the reviews. Then ask the uncomfortable question: if a bad proposal came through tomorrow, would anyone actually catch it?
