Why does every AI agent need a human approval gate?

Because when an agent goes wrong, it goes wrong at machine speed. A human makes a bad call and catches it three actions later; an agent makes a bad call and is forty actions deep before you've looked up. The fix isn't watching every step — that throws away the leverage. The fix is a gate at the plan level: the agent proposes, a human approves, then it executes.

My working rule sits at the top of my own site: always a human orchestration layer. That's not a slogan about liking humans. It's an engineering position I hold after running agents in production daily — across a 17-paper news network, a client agency, and the internal systems that keep both alive.

The two failure modes people actually hit

Full autonomy fails on error compounding. Each step an agent takes is conditioned on the steps before it. One wrong assumption early — wrong file, wrong account, wrong interpretation of an ambiguous instruction — and every subsequent action is confidently built on it. The agent doesn't feel doubt accumulating the way a person does. It just keeps going.

Step-by-step approval fails on economics. If a human has to click "yes" forty times per task, the human stops reading what they're approving by click six. You've kept the liability and thrown away the throughput. Worse, you've trained yourself to rubber-stamp — which is more dangerous than honest autonomy, because now there's a ritual of oversight with none of the substance.

The gate that works: approve the plan, not the steps

Plan-gating sits between the two. The agent reads the task, does its reconnaissance, and produces a plan — what it intends to do, to which systems, in what order, with what stopping conditions. A human reads that and approves it once. Then the agent executes the approved plan freely, and returning to the human is required only when reality diverges from what was approved.

This works because plans are where mistakes are cheap. A wrong plan costs you the thirty seconds it took to read it. A wrong execution costs you whatever the agent touched. Reviewing one plan is also a task humans are actually good at — you can hold a whole plan in your head, judge it against context the agent doesn't have, and catch the wrong-account, wrong-target class of error that step-level review misses because each individual step looks reasonable.

I hold this position strongly enough that I built it into a harness: OCTI, my fork of the open-source OpenClaw agent framework, adds exactly this — a plan-gated loop where every plan turn is approved by a human before execution. The fork exists because I wanted the gate to be structural, not a prompt suggestion the model can drift past.

Where the gate belongs (and where it doesn't)

Not everything needs one. My rule of thumb after two years of running this daily:

Gate it when the action is irreversible, public, or touches money, credentials, production systems, or another person's data. Publishing an article. Sending the email. Deploying to prod. Changing DNS.

Don't gate it when the action is read-only or trivially reversible in a sandbox. Research, drafts, analysis, test runs. Gating those just reintroduces the babysitting problem and burns the human's attention budget you're trying to protect.

The attention budget is the real resource. A well-designed harness spends human judgment only where judgment changes the outcome — and spends it on plans, where it's most effective per second.

The uncomfortable part

The industry pressure runs the other way. Every demo rewards the agent that never stops to ask, and "fully autonomous" reads better in a pitch than "supervised." But I publish local news in real communities under real names. When a system of mine acts, someone accountable has approved what it set out to do. That's not caution slowing down the future. That's the only version of the future where the people running these systems deserve to keep running them.

The agent does the work. A human owns the intent. Keep those two jobs separate and agents are the best leverage a small operator has ever had. Merge them, and you find out at machine speed why they were separate.