Every AI operations deployment eventually faces the same question: what is the system allowed to do without asking?
Answer "nothing" and you have built an expensive suggestion box. Answer "everything" and you have created a liability nobody signed up for. The useful answer is a specific line, drawn on a specific principle.
The principle
The line is not risk. Risk is a slider and it invites endless argument. The line is reversibility and direction.
Runs free: anything internal and reversible. Reading, classifying, enriching, drafting, monitoring, flagging, scheduling internal work, updating internal records that can be corrected.
Requires a gate: anything outward-facing or hard to reverse. Communication reaching a customer. Movement of money. Creation of a record someone external will rely on. Commitments made on the company's behalf. Deletion of anything.
This rule is easy to apply, easy to explain to a risk committee, and it does not require re-litigating each new feature.
Making the gate work in practice
A gate that is ignored is not a gate. Four properties separate real ones from theater.
It arrives where the person already works. A queue in a separate application is a queue nobody opens. The approval belongs in the tool that person is in all day.
It is fast to act on. The reviewer needs the draft, the reasoning, the source material and the approve/edit/reject action in one view. If approving takes as long as doing it manually, the system has no value.
Editing is as easy as approving. If the only options are accept or reject, reviewers accept things they would have improved. The edit is also your highest-value training signal, so the interface should invite it.
It degrades safely. What happens when nobody reviews for two days? Queue silently, or escalate? Almost always escalate — a backed-up queue means work is not happening and someone should know.
What to record
Every gated action should leave a durable record: the inputs, the model, the generated output, any human edit, the approver, the timestamp, and the final action taken.
This is what makes the process defensible a year later when someone asks how a particular thing was decided. It is also what makes improvement possible — the edit history is a map of exactly where the system is weakest.
Loosening the gate over time
Gates should tighten and loosen based on evidence, not enthusiasm. The pattern that works:
Start with everything gated. Measure the approval rate per action type. Where a category has been approved unedited at a high rate over meaningful volume, consider moving it to spot-check — a sample reviewed rather than every instance. Where edit rates are high, keep the gate and fix the underlying prompt or context.
Note the direction: evidence loosens the gate for the specific narrow category that earned it. What does not work is loosening globally because the system "seems good now."
The category that never loosens
Money and legal commitments stay gated permanently regardless of accuracy, because the failure cost is unbounded and the volume is low enough that the gate costs almost nothing. This is not a statement about model capability. It is a statement about which errors you can absorb.