Teams adopting agents keep asking how much the agent should be allowed to do on its own. It is the wrong question, because the honest answer is "it depends on the step," and that is not a policy. The useful question is narrower: at which moments must the agent stop and ask? Our answer is four moments, and only four: anything external, anything irreversible, anything involving money, and any change to the agent's own rules. Everything else can run unattended.
Ethan Mollick put the reverse framing plainly in his One Useful Thing newsletter on August 31, 2026. We have spent years working out when people should ask AI for help, and almost no time on when an AI should ask us. The agent incident that dominated August 2026 made the gap concrete, and Martin Fowler pulled out the detail that stays with you: agents posted hundreds of thousands of messages to each other, and none of them checked with the people who ran the systems. Nothing in their design made asking the natural move.
We build and run agentic pipelines in production for content publishing, contract drafting, and onboarding. They run unattended for most of their length, and that autonomy is the point. Every one of them also stops cold at the same four moments. The list has held long enough that we treat it as a design rule.
When should an AI agent stop and ask a human?
An AI agent should stop for human approval at four moments, and we build each one as a gate: a checkpoint the pipeline cannot pass without a recorded human decision.
Anything that leaves the building. Publishing a post, sending an email, opening a ticket a customer can see. The artifact may be editable afterward. The fact that someone saw it is not. Our pipelines draft everything and publish nothing without a recorded approval.
Anything you cannot undo. Deletes, overwrites of the only copy, revoked access. Reversible actions can run all night. Gate on irreversibility itself, because it is a property you can check before the action runs.
Anything that moves money or commits the business. The agent can assemble the invoice or the contract draft. A person decides it goes out, because that person holds relationship context the pipeline cannot see.
Anything that changes the agent's own rules. Instructions, schedules, approval logic. A pipeline that can loosen its own gates does not have gates. It has suggestions.
Mollick's own list covers the first and third, plus access to sensitive material. We handle that one by scoping credentials before the agent runs rather than by asking mid-task. The two we add, irreversibility and self-modification, are the ones that fail quietly. You learn about them after the fact, which is the one time a gate cannot help.
The gate lives in the harness, not the prompt
Telling an agent to ask before anything risky is not a gate. It is an instruction, and a model under pressure to finish a task can reason its way past an instruction. The stop has to be structural, which means it lives in the harness: the code around the model that runs its tools and acts on its output. In our pipelines, the publish step looks for a saved approval record and exits when it finds none. The model never gets a vote on whether this moment counts.
That makes gate placement an architecture decision, not a prompting decision. The four moments are known before the pipeline runs, so each checkpoint can live in code. The code logs every crossing and leaves an audit trail that a client or an insurer can read later.
Gate scarcity is the discipline
Gating every step fails too, because a person asked to approve forty routine steps a day stops reading them. Anthropic's data on Claude Code shows this at scale: users approve 97 percent of permission prompts, and in a controlled study, human reviewers missed most of the dangerous commands hidden in that stream. Approval fatigue is not a training problem. It is what happens when the gate design hands triage to a tired human, and it is the same capacity problem we see when AI coding moves the bottleneck to code review.
The four gates hold because nothing else asks. Human attention goes only where the answer is not obvious, so the person still reads the request.
Teams that expect either full autonomy or full supervision find the result odd at first. The agent works freely for almost the whole pipeline and stops at four doors. That balance is what lets work run overnight without anyone waking up to a surprise. If you are designing an agent workflow and cannot yet name its gates, naming them is the first deliverable, before the model choice and before the tooling. Our AI implementation framework starts there.