Scoping a credential caps what an agent can ever attempt, but some actions are dangerous enough that even a correctly scoped, correctly authenticated request should not execute purely on the model's own decision. Deleting a production database, wiring a refund over a few hundred dollars, sending an email to an entire customer list, merging a pull request into a payments service — these are all actions a well-designed system might legitimately grant an agent the technical capability to perform, and still refuse to let it perform unattended, because the cost of a single wrong call is high enough that a human's explicit yes is worth the friction it adds.
The naive version of this control is a blanket confirmation dialog on every tool call, and it fails within a week: reviewers click through fifty routine confirmations a day without reading them, and the one truly dangerous request slips through in the same reflexive click as the other forty-nine. A gate that fires too often trains the human to stop gating, which is worse than no gate at all, because it creates the appearance of oversight without the substance of it.
This lesson builds approval gates that fire selectively, on risk, and are structured so the human reviewing them actually has enough context to make a real decision in the few seconds they will actually spend on it.
Analogy🏏Cricket
🏏 Think of it like cricket: A DRS review in international cricket is not something a fielding captain gets to call for on every single delivery — each team gets exactly two unsuccessful reviews per innings, which forces the captain to reserve that human judgment call for the moments that actually matter. When Virat Kohli reviewed a marginal caught-behind decision against Steve Smith in a tense session, he was not gambling on a routine appeal; the fielding side's on-field reads, the wicketkeeper's reaction, and the bowler's certainty had already filtered out the great majority of appeals that never reached review at all. If DRS reviews were unlimited and free, captains would call for one on every appeal out of habit, the third umpire's booth would be reviewing decisions with no real doubt attached to them, and the reviews that actually needed careful scrutiny would drown in the noise of routine ones. Just as a limited review budget forces a captain to reserve human scrutiny for genuinely uncertain moments, an approval gate has to be scoped to genuinely high-risk actions rather than firing on everything, or the human reviewing it stops treating any single review as meaningful. The insight is that human judgment is a scarce resource, and a gate that spends it carelessly on routine decisions has none left when a decision that actually needs it arrives.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.