Human Gate

The problem #

Today’s “human in the loop” is either an endless stream of prompts or nothing at all. Anthropic reports that Claude Code users approve 93% to 97% of permission prompts; in its controlled experiment, people caught only 13.6% of planted dangerous commands, and did worse as sessions got longer. This is vendor research done to promote auto mode, and it measures spotting planted prompts rather than production incident rates, but the direction is clear.

The same data holds another number: users reject 39% of plans but only 3% of individual permission requests. What people judge seriously are plans and merges, not every tool call.

How it works #

• It appears in few places: merging into a protected tree, deleting from a protected tree, sharing or publishing externally, egress, widening a lease and lowering a label. Writes on a branch need no approval.
• The granularity is a plan or a merge. Review one PR, not fifty prompts.
• The Gate Card is rendered by the NAS: the real diff, a read-manifest summary, the lease and the session taint, never the agent’s own account. Options: approve, approve narrowed, deny; a timeout defaults to deny.
• An approval is bound to the action digest: it binds the diff hash and the lease and cannot be replayed.
• Delivery: push, chat, email or CLI; it can be delegated; passkeys are an optional strong authentication.
• Escalate only. An optional risk classifier (including an LLM) may only escalate an action to a gate and never approve one. A model can only tighten, never loosen.
• Fatigue is measured: approval rate and time to approve; when the approval rate is unusually high, that suggests merging gates or tightening policy.

Start small #

• A protected main plus PR review (any Git platform will do) and a push notification.
• Or a CLI: nas gate approve <gate_id>.
• Make the Gate Card show the “real diff” first; do not rush into fancy interfaces.

Interface sketch #

Illustrative only. Field names may change before specification v0.3.

{
  "gate_id": "gt_2Mx4",
  "run": "run_91ab",
  "action": {
    "op": "merge",
    "from": "cleo/run_91ab",
    "into": "main",
    "files_changed": 4,
    "diff_sha256": "7d2a..."
  },
  "why": "Release notes are ready for review",
  "risk": {
    "session_taint": ["external"],
    "sources": ["web:example.com/changelog"],
    "destructive": false,
    "egress": false
  },
  "options": ["approve", "approve_narrowed", "deny"],
  "default": "deny",
  "expires_at": "2026-11-12T12:00:00Z"
}

What the specification asks for #

• A Gate Card MUST show the real diff computed by the NAS, not the agent’s description of it.
• An approval MUST be bound to the action digest and the lease and MUST NOT be replayable.
• The default outcome of a timeout MUST be denial.
• A classifier or an LLM MUST NOT grant approval; it MAY escalate an action to a gate.
• Merging into a protected tree, deleting from a protected tree, external sharing, egress, widening a lease and lowering a label MUST go through a gate.
• The NAS SHOULD report the approval rate and the time to approve.

Borrowed, and what is new #

What follows is all established practice. What is new: anchoring approval on the merge at the storage layer and having the NAS (not the agent) render the content. Approval and PRs themselves are not new.

• How we built Claude Code auto mode
• Anthropic: approval data behind auto mode
• CaMeL
• WebAuthn
• OpenID CIBA

Honest limits #

• A person can still approve the wrong action; batch review also causes fatigue.
• Notification channels can be phished.
• An approval cannot stop something outside what was approved; that is the lease’s job.

Open questions #

• What is the best interface for batch and tiered review?
• How is the threshold for automatic merging measured and tuned?

Questions #

Related concepts #

• Capability Lease A narrow authorization for one run, with an expiry and budgets. Child leases can only be narrower.
• Trust Labels Two small labels plus session taint enforce the Rule of Two.
• Agent Branch Each run works on a copy-on-write branch. Only a reviewed merge reaches the main line.