Rule
Human approval gates exist at phase boundaries — ideate → plan, plan → build, review → ship — not at individual tool calls within a phase. Within a phase, the agent operates autonomously using its scoped tools.
Why
Per-call approval breaks the agent’s reasoning flow and burns the operator’s time on micro-decisions. Phase boundaries give the human meaningful, infrequent decision points where the agent has produced reviewable evidence (a plan, a build, a verification report) and the human can act on substance instead of rubber-stamping every step. This matches the IT4IT value-stream gate model: governance happens at the transition, autonomy happens inside the stream.
The exception is proposal-mode tools: any action that affects production (deploying, registering products, modifying user data) presents a card for explicit approval regardless of phase, because the blast radius is too high for autonomous execution.
Applies To
Every population governed by DPF — in-platform coworkers, external coding agents working on the codebase, and the humans operating the platform. The contract is symmetric: agents respect the gate, humans honor the autonomy inside it. Does NOT apply to first-time bootstrap flows where the human has not yet defined phase boundaries (those run under different setup-mode rules) or to read-only operations (queries, inspections) which never gate.
How To Apply
Implementers gate phase transitions deterministically — a build cannot move from review to ship until the design-review-required and tests-pass checks have passed and the human has approved the summary. Inside a phase, do not insert per-call confirmation prompts; trust the scoped tool grants and let the agent run. For production-affecting actions inside a phase, route through proposal-mode tools so the human sees a card before the side effect executes. Phase exit produces durable evidence (a plan document, a verification report, a contribution ledger) so the approval is grounded in artifacts the human can audit later.
Decision Dimensions
governance_compliance: 1.0— phase-boundary gates ARE the governance substrate; this principle is what makes that substrate operationally meaningful.human_cognitive_load: -0.6— strongly favors the option that reduces interruption load on the operator. Per-call approval has the opposite sign on this axis; this principle exists precisely to bend the system away from that pattern.speed_to_value: +0.5— autonomous operation within a phase materially shortens the cycle. The principle does not maximize raw speed (governance and cognitive-load axes still win at the boundary), but it removes the throughput tax of per-call review.
Examples
- Positive: A coworker building a feature receives plan approval at the phase boundary, then runs 40 tool calls inside the build phase (edits, tests, lints, commits) without any prompts; at the ship boundary, the human reviews the summary and verification evidence and approves.
- Counterexample: A workflow that asks the user “should I run the tests?” or “want me to continue?” between every action inside a phase. This burns the operator’s attention on micro-decisions and signals the agent doesn’t trust its scoped tool grants — the wrong place to put a gate.
Sources
(Rendered from the sources: frontmatter by WikiSourceCitations — do not duplicate citation prose here.)