The freeze that was never a gate
In July 2025, SaaStr founder Jason Lemkin was nine days into a public experiment with Replit’s coding agent. He had declared a code and action freeze. The agent ran destructive commands against his live database anyway, wiping records on 1,206 executives, then told him a rollback wouldn’t work. It would have. He recovered the data himself.[1]
The freeze existed as an instruction. It didn’t exist as a gate. Nothing in the system made the agent stop and wait for a person before an irreversible write. Replit’s CEO called the outcome unacceptable,[2] and the company then shipped separate development and production databases.[3]
I keep coming back to one simple rule for designing agentic workflows: map the gates, not just the steps. This piece covers why that framing matters, what four decades of human factors research says about it, and how I would run it with a product team.
- A step is something that happens. A gate is where the work stops until a named person decides and owns it.
- Place gates on purpose. Too many and you’ve built an approval queue. Too few and you get the Replit story.
- Design the gate itself. A gate with one button and no context is a rubber stamp, and people stamp fast.
Why step maps hide the risk
A typical workflow diagram answers one question: what happens next. For deterministic software that was enough, because the system did exactly what the arrow said.
Agents break that contract. They decide how to reach a goal, they pick their tools, and the same request can take a different path tomorrow. A box labelled “Gathers context and drafts” quietly hides dozens of choices the agent made on its own.
So a step map shows sequence but not authority. It doesn’t say who may commit the outcome, who answers for it when it goes wrong, or what the next person needs in order to judge it. Those are the questions that matter on the day something breaks.
And accountability doesn’t move into the agent’s lane just because the agent did the work. When Air Canada argued that its chatbot was responsible for its own wrong answer about bereavement fares, the British Columbia tribunal rejected the idea outright and held the airline liable for everything on its site, bot included.[4] Every lane, including the AI lane, has a human owner. A good map names them.
A step map shows order. A gate map shows who answers for it.
A gate is a decision, not a checkpoint
A step is something that happens. A gate is a point where the work can’t move on until a named person has made a judgment and owns it. The agent can gather, draft and recommend, but at a gate the authority to commit sits with a human.
The word isn’t new to agent builders. Anthropic’s guide to building effective agents draws a “gate” in its prompt chaining pattern, but there it means a programmatic check between steps.[5] That distinction is useful. Some gates should be code, like schema validation or a test suite. Human gates are for what code can’t judge: intent, tone, fairness, consequence.
Here is a simple flow: six steps across three lanes, with two human gates. I ask the same three questions of every flow I map. Ask them of this one.
- 01Business user
Submit the request
Owner: Requester, for example an operations manager
- HandoffGoal, constraints, deadline
- 02 AI agent
Gather context and draft
Owner: Agent owner, the product team that runs the agent. An AI lane still has a person who answers for it.
- HandoffDraft, sources, what changed, confidence, open questions
- 03ReviewerHuman gate 01
Check and correct
Owner: Domain reviewer, with a named backup
- HandoffCorrected draft, the reviewer’s edits, the decision
- 04 AI agent
Act on the approved draft
Owner: Agent owner
- HandoffWhat it did, what it touched, how to roll it back
- 05ReviewerHuman gate 02
Approve the outcome
Owner: Service owner, who answers for what leaves the building
- HandoffApproved outcome and its audit record
- 06Business user
Receive the outcome
Owner: Requester
Six steps, two human gates. Pick a question to see what the map should answer.
- Who owns each step?A role with a name, never “the system”.
- Where must a human decide?Not where a person could glance at something, but where the flow stops until they act.
- What context travels at every handoff?Enough for the next owner to judge well without redoing the agent’s work.
That’s why a good gate map draws every handoff as its own object, not just an arrow between boxes. Healthcare shows why it matters. When nine hospitals introduced the I-PASS structured handoff program, errors dropped across 10,740 admissions.[6]
Handoffs are where context leaks, and agents add a lot more of them.
Human factors got here first
None of this started with large language models. Aviation, process control and healthcare have studied people supervising automation for over forty years, and four findings map almost directly onto agentic workflows.
Finding 01Automation is a dial per function
Parasuraman, Sheridan and Wickens proposed in 2000 that automation applies to four kinds of work: acquiring information, analysing it, choosing a decision, and carrying out the action. Each can sit at a different level.[7] Read the six-step flow above through that lens and it’s a function allocation. The swimlanes make the levels visible.
Finding 02Taking the easy parts makes the hard parts harder
Lisanne Bainbridge’s Ironies of Automation (1983) argued that when most work is automated, people are left with tiring monitoring and the rare, difficult interventions, while the skills those interventions need fade from disuse.[8] A reviewer who only ever approves agent drafts slowly loses the expertise that made them a good reviewer.
Finding 03Passive people lose the picture
Endsley and Kiris showed in 1995 that when an expert system took over a navigation task, operators’ situation awareness dropped and their decisions slowed once it failed. The cause was the shift from active to passive processing, and the level of control people kept made the difference.[9] A gate where someone corrects and chooses keeps them in the loop. A gate where they click OK doesn’t.
Finding 04Being an expert doesn’t protect you
Parasuraman and Manzey’s 2010 review found automation bias in novices and experts, in teams as well as individuals, and noted that training or instructions alone didn’t prevent it.[10] People miss what the system missed and act on what it got wrong. Gates have to be designed against that bias, not just staffed.
The 2026 evidence
The old findings now have new numbers, measured on real agents. They point the same way.
13.6%
Dangerous command caught // 2026
1,053 paid testers saw one dangerous command hidden in routine permission prompts. The catch rate fell to about 5% after 50 prompts.[19]
97/39%
Prompts approved // plans rejected
People approve almost every single command, yet push back on four in ten whole plans.[19]
42.4%
Agent PRs approved, with experience
Up from 27.9% across 11,429 reviews, while inline comments fell 22%. The authors read it as habituation.[20]
2×
Agent asks // person interrupts
On the most complex tasks, Claude Code stops for clarification more than twice as often as people interrupt it.[11]
There’s a twist in how experienced people supervise. Anthropic’s analysis of real Claude Code use found that full auto-approve rises from about 20% of sessions for new users to over 40% by 750 sessions. Yet experienced users also interrupt more, around 9% of turns against 5%.[11] They move from approving every step to monitoring and stepping in.
Anthropic’s conclusion is that oversight is less about approving every action and more about being positioned to step in when it matters. That’s exactly why gates belong at a few deliberate points, with good visibility and a working stop control everywhere else.
Medicine saw the rubber stamp years ago, with clinicians overriding 49 to 96% of drug safety alerts.[21] Every gate that fires for nothing teaches people to click through the one that matters.
Where the gates belong
Gate every step and you have built an approval queue with extra clicks. Gate nothing and you get the Replit story. Placement is the real design work, and I run four questions in this order.
- 01Can it be undone?If reversing an action costs more than doing it, a person commits it. Deleting data, sending money and publishing all qualify.
- 02Does it leave the building?Anything that reaches a customer, a regulator, a payment or another system of record. Air Canada’s wrong answer reached a grieving passenger.
- 03Can code judge it?If a deterministic check can decide, make it a programmatic gate. Spend human attention only on what code can’t judge.
- 04Is the agent unsure, or is the case new?Low confidence, missing data or a situation outside the usual pattern should go to a person, not get forced through.
On this site’s design system, Datum, the answers set a risk tier, and the tier sets the gate: R1 has none, R2 shows an intent preview, R3 asks for approval with a reason, and R4 needs a typed confirmation by a named person. Try it on an action.
- 01Can it be undone easily?
- 02Does it leave the building?
- 03Can code judge it?
- 04Is the agent unsure, or the case new?
No human gate
Nothing here is hard to undo, leaves the building or worries the agent. Let it act, and log what it did.
Logged 14:32. No approval asked.
Goes ahead unless you stop it.
Only the data owner can confirm this. Type MIGRATE 1206 to continue.
Type to confirmR1, no human gate. Change an answer to see the tier move.
That fourth question works in both directions: the agent can raise its own hand. Remember the 2× figure. Design agent-initiated stops into the map as deliberately as human ones, because they’re a gate the agent opens for you.[11]
Getting placement wrong is expensive. Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027, citing rising costs, unclear value and weak risk controls.[12] Too many gates kill the value. Too few kill the trust.
RegulationThe law already describes a gate
Article 14 of the EU AI Act says oversight of high-risk systems must be proportionate to the risk, the level of autonomy and the context of use.[13] It then lists what the person overseeing must be able to do. Read as a designer, that list is a gate specification.
- Understand the system’s limits, so the context packet says what the agent can’t do.
- Stay aware of automation bias, so the gate asks for a judgment, not a click.
- Interpret the output correctly, so evidence comes before the recommendation.
- Override or reverse it, so there is an exit besides yes.
- Halt the system safely, so Stop is always on the gate.
The Act even writes a two-person gate into law. For remote biometric identification, no action may follow a match until two competent people have verified it separately.[13] In the US, the voluntary NIST AI RMF asks organisations to define and differentiate roles for human-AI configurations and to document oversight processes.[14] A gate map is one of the most direct ways to produce that evidence.
| Framework | What it asks | Where it stands |
|---|---|---|
| EU AI Act, Article 14 | Oversight proportionate to risk, with the power to override and halt | The Digital Omnibus moved high-risk duties, oversight included, from 2 August 2026 to 2 December 2027.[15] |
| Singapore, agentic AI framework | Define the significant checkpoints that need human approval | Published January 2026,[16] and it calls for auditing whether those approvals actually work.[17] |
| NIST AI RMF | Define roles for human-AI configurations, document oversight | Voluntary. NIST began an AI Agent Standards Initiative in February 2026, with no final agent standard yet.[18] |
So there is time, but not a reason to wait.
Designing the gate itself
A gate on a map is a promise. The interface at that gate is where the promise is kept or quietly broken. Here is the same gate, designed two ways.
- Goal
- Summarise Q3 vendor terms for the renewal call
- Sources
- 3 contracts, 1 email thread
- Changed
- Payment terms rewritten from 60 to 45 days
- Unresolved
- Two contracts disagree on the notice period
Judgment gate. A context packet, one active task, four exits and a record.
Principle 01Fight the rubber stamp
Remember the 13.6% catch rate. Keep human gates rare enough to mean something, make high-consequence gates look and feel different, and watch override rates. Guidance on Article 14 treats suspiciously low override rates as a sign of automation bias, not proof the system works.[22]
Principle 02Ask for a judgment, not a signature
People approve 97% of single commands but reject 39% of whole plans.[19] They engage when asked to judge an approach, and click through when asked to bless one command. That matches Endsley and Kiris: design the gate so the reviewer actively does something, such as picking between options, editing the draft or confirming the one fact that matters. Microsoft’s Guidelines for Human-AI Interaction name the same ideas: support efficient correction, and scope services when in doubt.[23]
Principle 03Send a context packet, not a sales pitch
A bare “needs review” ping forces the reviewer to redo the agent’s research. The packet should carry the goal as the agent understood it, the sources it used, what it changed, how sure it is and what it couldn’t resolve.
But be careful with persuasive reasoning. In a field experiment with MIT Solve, screeners followed AI recommendations 12 percentage points more often when the AI added a narrative rationale, on subjective criteria.[24] Lead with evidence and uncertainty, not a confident story. Lee and See’s work on trust in automation argues for calibrated trust, not more trust.[25]
Principle 04Give every gate an exit besides yes
Approve, correct, send back and stop are four different decisions. Article 14 expects people to be able to override or reverse an output and halt the system safely.[13] A gate with one button is a formality.
Principle 05Keep the reviewer’s skill alive
Bainbridge’s warning applies here. Rotate reviewers through doing the task by hand now and then, and sample-audit approved outcomes, so the people at the gate stay experts rather than spectators.
“It is perhaps the final irony that it is the most successful automated systems, with rare need for manual intervention, which may need the greatest investment in human operator training.”
Run a gate-mapping session
This works as a 90-minute workshop with a product owner, a designer, an engineer and someone who does the work today. The output is a swimlane gate map plus one gate card for each human gate.
- 01Start from the outcomeWrite the delivered result on the far right and name the person who answers for it.
- 02Draw a lane for every actorEach human role, each agent and each system of record gets its own lane. If you can’t name a lane’s owner, stop and settle that first.
- 03Place the steps, then mark the risky onesCircle every write action and every arrow that crosses into a customer, money or another system.
- 04Run the four placement questionsMark human gates in one colour and programmatic checks in another. Most steps should end up with neither.
- 05Fill a gate card for each human gateUse the template below.
- 06Walk the unhappy pathsThe agent is unsure. The reviewer rejects. The reviewer is on leave. The agent fails halfway through an action. Each path needs a defined route.
- 07Instrument and revisitTrack override rate, time per review and rework after each gate. Move autonomy up or down every quarter on the evidence, not on enthusiasm.
| Gate card field | What to decide | Example: Check and correct |
|---|---|---|
| Owner | The role accountable for the decision | Domain reviewer |
| Decision options | Every exit, not just yes | Approve, edit and approve, send back, stop |
| Context packet | What arrives with the work | Goal, sources, changes, confidence, open questions |
| Active task | What the reviewer must actually do | Confirm the key figure, edit the draft |
| Time budget | Expected review time, and what happens on timeout | Escalate to a backup reviewer, never auto-approve |
| Evidence | What gets logged for audit | Decision, reviewer, timestamp, edits made |
| Health signal | The metric that shows the gate is working | Override rate and time per review |
GATE CARD
Gate: ____________________ (gate 0_)
Step it guards: ____________________
Risk tier: R1 none / R2 intent preview /
R3 approval with a reason /
R4 typed confirmation by a named person
Owner: ____________________ (a role, never "the system")
Backup owner: ____________________
Decision options: Approve / Correct / Send back / Stop
Context packet: Goal as the agent understood it
Sources it used
What it changed
How sure it is (word + level)
What it could not resolve
Active task: The one thing the reviewer must check or choose
Time budget: ___ min. On timeout: escalate to the backup.
Never auto-approve.
Evidence logged: Decision, reviewer, timestamp, edits made
Health signal: Override rate, time per review, rework after the gate
Review date: ____________ (move autonomy up or down on evidence)
Fill one in for each human gate before anyone writes a line of agent code. If a field stays blank, that gate isn’t designed yet.
Fewer gates, better gates
The goal isn’t more human checkpoints. It’s fewer, sharper ones, each placed where judgment changes the outcome, and each designed so a person can genuinely use it.
The people at the gate
Fewer prompts, each with the context to judge it and a real choice to make. Their expertise stays in use.
Design and engineering
A shared map of where autonomy is allowed, so agents can move faster everywhere else without a fresh debate each sprint.
The business
Named owners and a record of every decision, which is what a regulator, an auditor or a tribunal will ask to see.
These are the outcomes the method is built for, not results I can promise. Measure them on your own workflow.
Steps tell you what the system does. Gates tell you who answers for it.
If your workflow map only shows the first, you’ll find out about the second on a bad day, the way Replit and Air Canada did.
Fair questions
Won’t gates slow the agent down?
Badly placed ones will. That’s the case for fewer gates. Most steps should have no human gate at all, and some should have a programmatic one instead. The few that remain sit where a wrong call costs far more than the wait.
Isn’t this just human in the loop?
Human in the loop says a person is somewhere. A gate says where, who, with what context, and which exits they have. That detail is what decides whether the person is actually in the loop or just near it.
What about fully autonomous agents?
The gates move earlier. Someone decides the scope, the permissions and the stop control before the agent runs, and someone still owns the outcome. Air Canada learned that the bot’s lane belonged to the airline.
Does a gate map make us compliant?
No. It produces the kind of evidence Article 14 and the NIST AI RMF ask for, but it isn’t a conformity assessment, and I’m not a lawyer. Treat it as design input for the people who own compliance.
Where the facts come from
- Why AI agents delete production databases (opens in new tab), The New Stack. The Replit code freeze and the 1,206 deleted records.
- AI coding tool Replit wiped a database during a code freeze (opens in new tab), Fortune, July 2025.
- Replit AI deletes production database (opens in new tab), YourStory, 2025. The fix: separate development and production databases.
- BC tribunal confirms companies remain liable for information provided by AI chatbot (opens in new tab), ABA Business Law Today, 2024. Moffatt v. Air Canada.
- Building effective agents (opens in new tab), Anthropic.
- Safer patient handoffs (opens in new tab), Harvard Medical School. Starmer et al., I-PASS, New England Journal of Medicine, 2014.
- A model for types and levels of human interaction with automation (opens in new tab), Parasuraman, Sheridan and Wickens, IEEE, 2000.
- Ironies of Automation (opens in new tab), Bainbridge, Automatica, 1983.
- The out-of-the-loop performance problem and level of control in automation (opens in new tab), Endsley and Kiris, Human Factors, 1995.
- Complacency and bias in human use of automation (opens in new tab), Parasuraman and Manzey, Human Factors, 2010.
- Measuring AI agent autonomy in practice (opens in new tab), Anthropic, February 2026. Auto-approve and interruption rates, and how often the agent asks.
- Gartner prediction on agentic AI project cancellations (opens in new tab), Outsourcing Today.
- EU AI Act, Article 14: Human oversight (opens in new tab), European Commission AI Act Service Desk.
- AI RMF 1.0, Core functions (opens in new tab), NIST. GOVERN 3.2 and MAP 3.5.
- EU Digital Omnibus on AI enters into force (opens in new tab), National Law Review, 2026.
- Singapore launches new Model AI Governance Framework for Agentic AI (opens in new tab), Ministry of Digital Development and Information, January 2026.
- Launch of a new Model AI Governance Framework for Agentic AI (opens in new tab), Stephenson Harwood, 2026.
- Research note: NIST AI Agent Standards Initiative (opens in new tab), Cloud Security Alliance, 2026.
- Auto mode is the default in Claude Code (opens in new tab), Anthropic, August 2026. The 1,053-tester study, and the 97% and 39% figures.
- Habituation at the Gate (opens in new tab), Yu et al., arXiv, 2026.
- Effects of workload, work complexity and repeated alerts on alert fatigue (opens in new tab), BMC Medical Informatics and Decision Making, 2017.
- Article 14 human oversight conformity (opens in new tab), Presencis. Low override rates as a warning sign.
- Guidelines for Human-AI Interaction (opens in new tab), Microsoft Research. G9, support efficient correction. G10, scope services when in doubt.
- Narrative AI and the human-AI oversight paradox (opens in new tab), Lane et al., field experiment with MIT Solve.
- Trust in automation: designing for appropriate reliance (opens in new tab), Lee and See, Human Factors, 2004.