---
id: "approval-gate"
title: "Approval gate for irreversible actions"
creator: null
url: "https://skillissue.dev/patterns/approval-gate.html"
level: null
category: "Agent harness"
models: null
source_date: null
date_added: null
---

# Approval gate for irreversible actions

Let the agent draft anything it likes, but require a human yes before it sends, deletes, pays or publishes.

## Problem


Most agent mistakes are cheap if they stay local: a bad file can be reverted. Some actions cannot be undone: sending an email, deleting data, running a migration, spending money, publishing something. A prompt that says "be careful" is not a control.


## Pattern


Classify actions by reversibility and enforce the gate in the harness, not only in the prompt:

- **Free:** read, search, edit local files, run tests in a sandbox.
- **Gated:** anything external, destructive or costly. The agent prepares the exact action (full message text, exact command, exact record IDs) and stops. A human approves that exact action.

Enforce it with tool permissions where your tooling supports it (allowlists, confirmation prompts, read-only credentials, dry-run flags). The prompt then explains the rule so the agent plans around it instead of hitting it by surprise.


## Template


```
## Action rules

You may do these without asking:
- Read any file in the repo; search; run tests and linters.
- Create or edit files inside <working dir>.

You must STOP and ask for approval before:
- Sending any message (email, chat, comment, PR, issue).
- Deleting files or data you did not create in this session.
- Running migrations, deploys, or any command against non-local systems.
- Installing packages, or anything that costs money.

When you need approval, output:
APPROVAL NEEDED
Action: <exact command / exact message incl. recipient / exact records>
Why: <one sentence>
Reversible: yes/no — <how to undo, if yes>
Then wait. Do not proceed on partial or implied approval.
```


## When not to use it


- Inside a disposable sandbox where nothing touches the outside world. There, a gate mainly slows you down.
- Do not rely on the prompt alone for anything truly dangerous. If a mistake would be serious, remove the capability (credentials, network) rather than asking nicely.