Approval Gates and Board Control: Human-in-the-Loop at Strategic Decision Points

Both kinds of approval funnel into the same machinery: pausedExecutions plus auditLog. When the executor hits a gated step, it does three things:

1. Snapshots the execution state (DAG cursor, partial outputs, context) into pausedExecutions.
2. Writes the proposed action into auditLog with the originating agent, goal, and parentTaskId.
3. Emits an approval event to the configured channels — Telegram, Slack, dashboard, mobile.

The execution stops. Nothing in the wallet moves. No tool is called. The approver sees not just "approve refund?" but the full ancestry: which Mothership goal, which team lead, which workflow, which prior tool calls, which budget reserved.

Approval is a vote. It is signed by a user account scoped through Better Auth, gated by workspace RBAC, and the resume action is appended to the same auditLog row. Decline is also a recorded outcome — it does not disappear silently.

Five Things Worth Gating

We have learned which decisions earn a gate and which would be noise:

• Hiring an agent — adding a new node to the workforce. The platform should not let an agent spawn another agent without a person reviewing the role, tools, and credentials.
• Changing a goal — Mothership-level intent shifts. Agents can refine how; humans own why.
• Exceeding budget — covered by hard caps. The pause is automatic; the resume is an approval.
• Granting new credentials — a new OAuth scope, a new secret. The credential set change is approved before it is bound to any workflow.
• High-blast-radius tool calls — mass email, refund above a threshold, prod deploys, payouts via Tochka, customer DSAR responses. Each tool can opt in to the gate with a simple flag on the ToolConfig.

Everything else runs autonomously, by design. Gating every single call is how you turn a workforce back into a busywork queue.

The Approver Experience

A good approval gate is not a popup. It is a brief: what is being proposed, by whom, against which goal, with what cost, with what alternatives. AACFlow renders this brief into whichever channel the workspace prefers. For a small team that is a Telegram message with two buttons. For a regulated org that is a dashboard with a comment field, a signing step, and an SLA timer.

Resume is one click. Decline is one click. Comment is mandatory for declines because the next agent that hits the same gate needs to learn from the rejection, not retry blind.

Behind the scenes, the resume call lands on the executor with the original executionId, looks up the snapshot, validates the approver's RBAC scope, and continues exactly where it stopped. No replay, no rerun, no token cost duplicated.

Without Gates, You Have Autonomous Catastrophe

The honest version of "fully autonomous agents" is: agents that can do anything until they do something they shouldn't, at which point nobody knows who is responsible. The legal exposure alone makes this a non-starter for any company beyond a side project.

Gates are how you ship autonomy responsibly. The agent does ninety-nine things on its own. The hundredth — the one that touches money, identity, customers, or strategy — pauses and asks. The audit trail names every approver and every decline.

That is not slowing the agent down. That is letting the agent run further than it could without a leash. Because everyone in the org knows when the leash will pull, they let it run farther.

Build Boards, Not Confirm Buttons

Stop thinking about HITL as a checkbox before a tool call. Think about it as governance: who has authority over what, signed off how, recorded where. AACFlow gives you the gates, the snapshot, and the audit. What you put behind each gate is your board's call.

Set up your gates first. Deploy your agents second. The order matters.