Permission Gates

Pain Signals — You Need This Pattern When:

• An agent has tools that can damage data, send messages, or move money — and "fully autonomous" feels wrong
• Users want autonomy for routine work but a brake on dangerous actions
• Operators need to enforce policy ("never run terraform apply without approval") without code changes
• Auditors ask "who approved this action?" and the answer is "the LLM did"
• Approval fatigue: too many prompts → users rubber-stamp; too few → unwanted actions slip through

Permission gates encode policy about intent. The sandbox bounds what can happen; the gate decides what should happen. Both are required for serious agent harnesses.

Core Principle

A gate is a function over (tool, args, context) → decision. Decisions are coarse (allow / block / require-approval); reasoning is fine-grained (rules, classifications, scopes). The gate runs before tool execution; failure to allow means the tool does not run.