What is Approval Gateway?
Also called Approval Gate, Action Confirmation, Permission Prompt.
An approval gateway is a control that pauses an automated action and requires an authorized person to confirm it before execution. Actions are classified by consequence, so routine reads proceed automatically while irreversible, costly, external, or cross-boundary operations wait for a decision. The gateway records who approved what, when, and on which exact parameters.
The gateway exists because an autonomous system's competence and its authority should be decoupled. A model can be excellent at drafting a refund and still lack the standing to issue one. Classifying by consequence rather than by capability lets a system act freely where mistakes are cheap and reversible while holding a boundary exactly where they are not.
Classification usually turns on a few questions. Can the effect be undone. Does it leave the organization. Does it move money or change entitlements. Does it touch another tenant's data. Does it delete anything. A clear rule set is preferable to a per-action judgment call, because judgment calls drift as prompts and models change.
Implementation determines whether the gate is real. The approval must bind to the exact parameters that will execute, or a request approved in one form can execute in another. It should expire, since a decision made against stale context is not an informed decision. It should fail closed on error or timeout. And the approver must see enough detail to evaluate the action rather than a bare confirmation prompt.
The main failure mode is human rather than technical. When a gateway fires constantly, approvers stop reading and click through, which converts a safety control into a logging mechanism with extra latency. Keeping the volume low enough that each request still receives attention is part of the design, not an operational afterthought.
Key points
- Separates what a system can do from what it may do
- Classify by consequence: reversibility, money, external, cross-tenant
- Approval binds to exact parameters and expires
- Fail closed on timeout or error
- Too many prompts turn approval into reflexive clicking
In practice
An operations assistant reconciles invoices. Reading records, matching line items, and drafting a summary run without interruption. Issuing a credit note pauses and presents the customer, amount, source invoice, and reason to a finance approver. The approval is bound to that exact amount and expires after one hour. If the assistant later recalculates a different amount, a fresh approval is required.