Problem
Agents become useful when they can act — and risky for the same reason. The gate design below makes every consequential action reviewable without slowing routine work.
States
| State | Meaning |
|---|---|
| Proposed | Agent has prepared an action and a decision card |
| Pending approval | Waiting for the owner or a delegated approver |
| Approved / Edited | A person approved, possibly with changes |
| Rejected | A person declined; the reason is captured for learning |
| Executed | Action performed; result attached |
| Rolled back | Reversible actions undone on request |
The decision card
Every card shows what the agent proposes, the evidence it used, the expected effect, whether the action can be reversed, and what happens if it is declined.
Rules
- Read and analyse: no gate.
- Internal write: no gate, always logged.
- Outward-facing, financial, production-changing: gate every time.
- Legal: never delegated to an agent.
Why a state machine
It makes behaviour predictable, testable and auditable — the three properties organizations need before they let software act on their behalf.