Your Approval Gate Is Training Data

People delete the human gate so they can say fully automated. That throws away the only proof the agent is getting better. Feed it back instead, and the gate teaches itself out of a job.

For about two months I told people my manager agents held the approval gate on purpose.

It sounded like architecture. The manager sees the whole run, so the manager should be the thing that stops and asks. I said it out loud more than once.

It was not a decision. The runtime could not hand work to a subagent yet. The manager was the only thing that existed, so the gate had nowhere else to sit.

When subagent support shipped, I split the managers into thin selectors that pick one move and pass it down, and the approval went with the work. That commit shows the whole thing in one diff: the manager loses its approval flag in one hunk, the agent doing the actual work gains it in the next.

Nothing about trust changed that week. My tooling caught up with where the gate always belonged, and I had spent two months describing a missing feature as a design principle.

Worth naming before anything else, because I see it everywhere including in my own writing: what your stack cannot do yet quietly becomes the thing you explain as intentional.

Where a gate belongs

One question decides it, and it has nothing to do with how good the agent has become.

Can you undo the last thing it does?

One of my agents makes quote images and posts them out. Single file, two jobs. Making the image is not gated. Publishing it is, and the file says so in the section heading. Same agent, same run. One action writes a file. The other cannot be recalled.

The blog agent goes further than most people are comfortable with. It writes the article, generates the images, commits them, and opens a real pull request against the live LifeHack site, with nobody watching. A pull request is a proposal. You can close it. So it runs unattended, and it is banned by name from merging or deploying, because those are the two verbs you cannot walk back.

I wrote the test into a commit message in July without noticing what I had written: generation writes to a temporary folder and publishes nothing, so it fails the irreversible-verb test for gating.

Put the approval on the verb you cannot undo. Everything upstream of it can run on a timer while you sleep.

Zero gates is a marketing target

Now the part I have changed my mind about.

Most of the energy around this goes into removing the human as fast as possible, because "fully automated" is a sentence people want to be able to say. I understand the appeal. It is also optimizing for the announcement.

I am not trying to get to zero gates. I am trying to watch an agent get better at its job, week over week, with something more solid than a feeling.

The gate is the only place that evidence exists. It is the one moment where a human looks at a specific piece of work and renders a verdict on it. Delete it early and you have not proven anything. You have removed the instrument and kept the confidence.

Which is a strange thing to do, given that the whole reason you wanted the gate gone was that the agent had earned it.

So treat the gate as a sensor

If the gate is where the judgment happens, then every verdict passing through it is signal, and signal is the one thing worth harvesting.

Some of that is already running. Seven automated reviewers read a draft before I see it. One of them states its own purpose plainly: it exists so that only drafts I would approve on the first try ever reach me. It runs eleven named attacks against every draft, each hunting for a reason to fail it, and when it is still unsure at the end it is told to reject, because a false pass spends my attention and my attention is what it was built to protect.

Those judges are kept weak in one specific way. They cannot stop a run and they cannot edit a draft. One says so in its own file: a judge that suspends is a judge error, and a judge that can edit the draft is not a judge.

But a judge only guesses at my standard. The better move is to capture the standard directly, from what I actually do at the gate.

Which is why the third button matters more than the two everyone talks about.

A pending gate in AgentUse. This is a demo fleet with seeded data, not live customer email, but the surface is the real one I use.

Approve and reject are decisions. Comment is the only one that leaves anything behind.

That part works today. When I reject something and type one sentence explaining why, that sentence gets stored as a rule with a source, a confidence, and a running count of how many times it has since been used. In March I turned down a draft with four words: don't judge this time. It had told a builder what was wrong with his own setup, which is not a thing I would ever do to someone sharing their work.

That sentence has been applied 84 times since. I wrote it once, in a text box, while mildly annoyed.

The system also learned something on its own that I would not have thought to write down. One agent keeps a note saying that when both automated reviews reject a draft, I reject it too, so the right move is to drop that target entirely rather than spend two of my gate cycles on it.

That is the shape of the thing. My gate actions stop being overhead and become the training set, and each one makes the next gate a little less necessary.

What I have been throwing away

Here is the uncomfortable half.

Since May I have rejected 95 things at the gate, almost all of them since July. 55 of those rejections have no reason attached. I clicked reject and moved on.

Every one of those is a verdict I made and did not record. The bad draft stopped, which is the cheap half of the job. Nothing upstream learned anything, which is the half that would have compounded. The same draft comes back the following week wearing a different hat, and I pay for the review again.

The agents have noticed, which is its own small indignity. One of them logs that the cause of a rejection is unresolved between three possibilities and asks for a one word note next time.

So my approval rate is not climbing, and I do not think that means I am being appropriately careful. I think it means I have been spending the most valuable thing in the loop, my own judgment on a specific piece of work, and then dropping it on the floor.

A gate that only stops bad work is overhead. A gate that explains itself is the mechanism that ends the gate.

That is the part I am building now. I'm building AgentUse, open-source infrastructure for autonomous agents, and the work in front of me is making an agent learn properly from what its reviewer does at the gate, so the loop closes on itself instead of routing through me forever. Not so I can say the human is out of the loop. So the human is out of the parts that stopped needing one.

So: the last time you rejected something an agent made, did you tell it why, and could it use what you said on the very next run?