Approval gates: what an agent may commit alone
Permissions for an agent workforce are graded by consequence, not by capability. Reversible and cheap: the agent acts and the record is reviewed later. Material or irreversible: the agent prepares and a named human resolves. The grading is the control; the credential is just plumbing.
Grade the decision before granting the access
The instinct is to start from what the agent can technically do and fence it off. The better order is to start from what it would cost to be wrong. An action that is cheap and reversible needs no gate and should not have one, because a gate nobody needs is a queue nobody services.
Anything that binds the organization externally — a payment, a contract, a public statement, a production deploy — sits behind a named resolver regardless of how confident the system is. Confidence is not a control.
Blast radius is the unit of risk
Ask what the worst plausible outcome of this agent acting wrongly is, and scope the credentials to that answer. Agents given a human’s credentials inherit that human’s entire reach, which is almost never the intent and is impossible to audit afterwards.
Scoped, per-agent credentials with a declared capability set make the blast radius a design decision rather than a discovery.
The two failure modes
Too little gating produces the incident everyone imagines. Too much produces the quieter failure: an approval queue that grows faster than anyone services it, until the workforce is technically deployed and practically unused. The second is far more common and much harder to see, because nothing breaks.
The signal to watch is time-to-approval rather than approval rate. A fleet whose work waits three days for a human is not a fleet.