Every autonomous agent demo eventually hits the same wall: a commenter asks, 'What stops it from deleting the database?' While most answers are shrugs, developer Galagent offers a concrete architecture based on a month of real-world desktop automation. Published on DEV.to on October 20, 2026, the article 'The Approval Gate' rejects the binary on/off switch in favor of a nuanced, tiered permission model.

Three Tiers of Control

Galagent argues that the worst design is a boolean flag. Instead, the system uses three distinct tiers based on reversibility and cost. Tier 0 covers cheap, reversible actions like reading files or taking screenshots, requiring no approval to maintain speed. Tier 1 handles expensive but reversible tasks, such as installing packages or running builds, which are pre-approved within a specific geographic scope like a workspace directory. Tier 2 is reserved for irreversible or outward-facing actions, including sending emails or spending money, which always require explicit user consent with the exact payload displayed.

Payload Visibility Over Intent

A critical component of this design is showing the user the concrete diff rather than a vague intent. The author notes that 'Approve: send follow-up emails' is useless, whereas 'Approve: 3 emails, to these addresses, with this text' is reviewable. If the interface cannot render the exact bytes or commands, the action is not ready for approval. This ensures that the human in the loop is actually reviewing the specific consequences of the agent's proposed action, not just a high-level summary.

Undo Beats Prevention

The philosophy extends to assuming failure. Galagent emphasizes that you cannot enumerate every dangerous command, so the system must make common damage reversible. This involves snapshotting before edits, using git commits for bulk changes, and soft-deleting into timestamped trash folders. By making 'undo' the primary safety mechanism, the approval gate only needs to catch the rare, truly irreversible actions. Dry runs are also treated as a core feature, not a debug mode, allowing the agent to print its full plan without executing it. For Galagent, the tipping point was realizing that 'install a package' is reversible in theory but a nightmare in practice. The article concludes that logging refusals is the most valuable part of the system, as rejected actions highlight where policy tiers are misaligned with reality. It’s a shift from trying to predict every danger to building a system that can survive its own mistakes.

Key Takeaways

  • Tiering should be based on action reversibility, not agent confidence levels.
  • Approval UIs must display exact payloads (bytes, commands, recipients) for review.
  • 'Undo' mechanisms like snapshots and soft-deletes reduce the burden on approval gates.
  • Refusal logs serve as free specifications for adjusting policy boundaries.

The Bottom Line

This is the pragmatic security model we’ve been waiting for; stop trusting model confidence and start trusting reversible architecture.