The approval gate.

Every agentic system we have shipped eventually asks the same design question: where does the human, or the stronger check, stand between the model and the world. The wrong answer is to gate the steps that feel hard and wave through the steps that feel routine. The right answer, the one we now apply as a default, is to gate on whether an action can be undone. A gate costs seconds. A recall costs a client relationship, a candidate pool, or a sales record nobody can trust again.

It is tempting to place approval gates wherever a task looks difficult: the step with the most branching logic, the output that reads the least like something a person would write. None of that tells you whether the step needs a gate. What tells you is a single question: if this action fires and it is wrong, can it be undone before it causes harm. Difficulty and irreversibility are different axes, and conflating them is how systems end up heavily gated in places that do not matter and wide open in the one place that does.

Irreversibility, not difficulty, is the line

A drafted message sitting in a queue is reversible: read it, edit it, discard it, and nothing has happened yet. A message that has already reached an inbox is not. A candidate score is reversible: recompute it, correct it, show the evidence behind it. A job posting already live on eight portals is not, and neither is an offer already extended. The line we now draw sits exactly there, and it has nothing to do with how sophisticated the model's reasoning was to produce the output.

The human gate

The recruiting operation we built and run for a national spirits brand puts this into practice at the point where it matters most. A Claude coordinator scores candidates, drafts outreach messages, and answers operator questions over Telegram all day, and none of that needs a gate, because none of it is irreversible on its own. But job posts, the advancement of a candidate past a group call, and hires all stop at a human approval message in Telegram, shown inline and editable before anything leaves the building. There is no code path around that gate, for the three kinds of action in the system that a team cannot take back once they land.

The same case study puts a number on the discipline: every job post and every hire in that system is human approved, by architecture rather than by policy. That distinction matters more than it sounds. A policy is a thing a busy team can forget under deadline pressure. An architecture with no code path around the gate cannot be skipped by accident, only removed on purpose, which is a much higher bar.

The gate between models

Contract Pulse draws the identical line one layer down, between two models rather than between a model and a person. Extraction from public contract documents runs on a fast model first. When its confidence in a document falls below a fixed threshold, the document escalates automatically to a stronger model rather than shipping a shaky answer forward. Most documents never escalate, and that is the point: the expensive model is an exception handler for the cases the fast model is honest enough to flag as uncertain, not a default tax on every document.

Call it the model-to-model version of the same idea. A human gate protects against an action that cannot be undone once it reaches the world. A confidence gate protects against a record that cannot be trusted once it reaches the evidence store, because the field is displayed and cited by a salesperson who has no way to know it was a low-confidence guess unless the system tells them. Neither gate exists because the model is assumed to be bad. Both exist because every model is wrong on some fraction of inputs, and the system has to decide in advance what happens on that fraction rather than discover it in production.

Gates are cheap, recalls are not

The asymmetry is the whole argument. A Telegram approval takes an operator a few seconds to read and tap. A confidence check adds one comparison and, occasionally, one extra model call. Neither slows a system down in any way a person would notice. Compare that to the other side of the ledger: an outreach message sent to an entire candidate pool cannot be unsent. A job posting live on eight portals cannot be quietly retracted without the client noticing. A contract record shown with false confidence has already shaped a conversation with a buyer by the time anyone checks the source document. Gates are the cheapest insurance a system can buy. Skipping them does not save meaningful time, it defers a much larger cost to the day something is wrong, and something is eventually wrong.

When we design where a gate goes, we no longer ask how hard the step is or how well the model tends to do on it. We ask what happens to the world in the second after the action fires, and whether that second can be taken back. If it can, the model runs freely. If it cannot, something checks first, a person in Telegram or a second model that costs more per call and earns its keep by disagreeing sometimes. Both systems are documented in full at /work/recruiting-agent and /work/contract-pulse.