Put gates where a human can genuinely judge and the damage cannot be contained. Everywhere else they manufacture the rubber-stamping that defeats them, and in the US no statute requires them, so this is a firm’s own policy choice to make well or badly.

The mechanism

Clear one myth first, because it distorts every conversation about this control. ECOA and Regulation B, the Bank Secrecy Act, the PATRIOT Act and the EU money-laundering directives do not mandate human review of automated decisions; they impose output obligations (accurate principal reasons for adverse action, whatever produced it) and require written, risk-based programs. There is no US statutory human-review floor for fund workflows. The real mandates are narrower: EU AI Act Article 14, high-risk systems only (Annex III now December 2027, and mostly not reaching a fund’s internal agents), and GDPR Article 22, for solely-automated decisions with legal effect. Everything else is firm policy backed by supervisory expectation and liability allocation, a stronger position to argue from than a rule that cannot be cited.

ISO/IEC 42001’s B.9.3 supplies the requirement worth borrowing: human reviewers checking outputs with authority to override the system’s decisions. Review without override authority fails as oversight, and is the most common way a gate gets built wrong.

What happens at scale is measurable, and encouraging. Across 998,481 tool calls in Anthropic’s telemetry, roughly 73% had a human in the loop and about 0.8% were classified irreversible. Both are upper bounds, since the classifications are model-produced and this is one vendor’s API traffic rather than agents generally. The companion finding is the useful one: full auto-approve rises from around 20% of Claude Code sessions for new users to over 40% at 750+ sessions, while interrupt rates rise from about 5% to 9% of turns. Experienced users grant more autonomy and intervene more: calibrated trust, the opposite of the decay curve.

The shipped state of the art is selective rather than universal. Across 30 deployed agents, approval mechanisms appear by task risk level and five offer no mid-execution intervention at all. Six are enterprise platforms that, once deployed, run at high autonomy on event triggers with no human involvement during execution: Glean, Google Gemini Enterprise, IBM watsonx, Microsoft Copilot Studio, n8n, OpenAI AgentKit. Copilot Studio on that list is the line to read twice: the platform most likely to be sanctioned at a fund ships event-triggered execution with no in-flight gate.

Now the failure modes, because this control has more than most. OWASP’s T10, Overwhelming Human in the Loop, treats flooding the approver as a technique. Microsoft’s failure taxonomy grounds it in prior art with measured failure rates from cookie banners and MFA fatigue, and names two defects: bypass by flooding, where the same action is retriggered until fatigue produces approval, and insufficient intelligibility for meaningful consent, where the prompt asks whether to allow sending an email and names neither recipient nor contents, the commoner defect and entirely self-inflicted.

Volume kills gates independently of any attacker. Approval requests multiply with every clarifying question, agent iteration and data access, so per-step approval fails to scale. CaMeL puts numbers on it: policies fired on roughly 27% of tasks, up to about 59% on the worst suite. Its diagnosis is the actionable part, since annotation quality rather than policy strictness drives how often a human gets asked. Its conclusion is the one to adopt: human confirmation is the exception path, reached after the capability system has automated away what it can.

State the upper bound plainly: a vigilant reviewer still misses covert exfiltration carried in non-printing characters. Gates fail when the reviewer is tired and when alert. What a mandatory gate buys is a conversion: an attack that could previously just execute must now deceive the overseer. That turns an access-control problem into a review-quality problem, which is progress only where review quality gets the investment.

One calibration point. Where humans retain genuine discretion over AI output they reject most of it: adherence to recommendations runs around 38% (IQR 23–50%), code-suggestion acceptance in the 27–46% band. An approval queue running near 100% shows an absence of judgment. And the AI-employee framing costs 18% of reviewer error-catching. A gate is a responsibility sink unless a named person owns the outcome.

The trend runs against this control. Approval processes are declining overall, and the functional split is the part that should worry a fund: down 15 points in finance and accounting, up 14 in IT. Approval is being relaxed in exactly the functions where agents touch money.

What to do

Place gates by containment, not by a vague “high risk” label. The sharper axis is whether harm can be contained afterwards: revoking a leaked credential limits misuse but does not un-leak it. For a fund a wire is irreversible, a trade containable at a cost, a draft memo reversible. Gate the first, monitor the second, leave the third alone. The reversibility axis comes from the sources; the wire/trade/memo assignment is us applying it to a fund, and a firm’s own list is the thing to argue about in the first policy meeting rather than a table to adopt.

Approve the plan, not the keystroke. Reviewing and editing a whole intended plan up front, with the ability to interrupt mid-execution, is the best-attested proactive approval design and it attacks fatigue directly. Pair it with per-action permissions (always-allow, needs-approval, block) so the exception path stays small.

Name the person who assigned the task as accountable for the outcome. That answers “who bears the cost of being wrong”, the question the accountability research says goes unanswered. Ownership of the outcome is a separate role from approval. The requester wants the action to go through, so requester-approves is self-approval with a signature on it, and it manufactures the near-100% approval rate this page just described as failure. Split the two: the requester owns the consequence, a second named person clears the irreversible action. A firm too small to staff that split should write that down and gate fewer things, rather than keeping the gate and losing the meaning.

Put content in the prompt: recipient, data touched, whether the action is reversible. An approval request omitting these asks for a click rather than for consent.

Triage with a monitor before triaging with a person. A smaller, trusted model flagging risky actions so only those reach a human is how approval survives volume; its failure mode is the monitor’s false-negative rate, now a number the firm owns, and the triage layer is described in runtime guardrails.

Rate-limit approval requests and alert on abnormal rates: a spike in low-priority approvals is the flooding attack’s signature, and cheap to detect.

Add reauthorization for long-running unattended agents — a periodic time-out forcing a human back into the loop — and make post-hoc-reviewed actions more easily reversible than the gated ones, a rule two independent sources reach separately. Undo plus damage confinement is an alternative to a gate, not a supplement.

Treat gates as the compensating control while evals are immature, and write down what would justify relaxing them: gates on Day 1, narrowed as evals earn the space.

How you’d know it’s working

Rejection rate per agent is non-zero and someone watches it in both directions: near-zero means rubber-stamping, a sudden rise means a misconfigured agent. The best metric this control has.

Seeded bad requests get caught. If a planted dangerous action passes, the gate is a log rather than a control.

Time-per-approval stays stable as volume grows, and approvals per reviewer per day are capped by design rather than by exhaustion.

What this doesn’t solve

Where a human cannot judge the action, a gate cannot supply the judgment. The tautology at the centre of this control is that we ask humans to supervise systems built to outperform humans, and the legal scholarship is clear oversight alone cannot carry the load. Gate where a person can actually evaluate the action; elsewhere, spend the money on architecture.

A gate falls short of a containment boundary. It stops an action pending review and does nothing about what the agent’s identity can still reach once the reviewer says yes, or about actions nobody thought to gate. See egress control and identity and access.

The evidence for gates is thinner than the evidence against them. Defined human-validation processes distinguish self-identified AI high performers (65% versus 23%), and even mature adopters invest more in human-decides modes than agent-decides-and-implements. Both findings are correlational, self-reported and large-enterprise, against experimental failure research.

And whether human oversight is meaningful at all remains unmeasurable. It was an open question in 2023 and still is: nobody can currently show a gate does anything beyond producing signatures.

See also

• Oversight decay — the failure this control must be designed against rather than into.
• Unreliable output acting on your systems — the concern the commit boundary answers.
• Runtime guardrails and policy enforcement — the automated triage deciding which actions reach a human.
• Promotion gates — approval applied to lifecycle transitions instead of actions.
• The reviewer pool — who staffs the gate and how they stay sharp.
• Logging and audit — recording the decision, not just that a prompt appeared.