An ops agent has access to three actions: send_email_to_customer, update_internal_customer_record, and delete_customer_account. Currently it executes any of them autonomously when its reasoning concludes they're appropriate. The team has had two close calls — one accidental account deletion (recovered manually) and one tone-deaf email to a frustrated customer.
Which actions should require explicit human approval?
Why did you pick that answer? Two or three sentences. The act of articulating it is what builds the judgment — not the click that follows.
Approval gates are a per-action design decision, not a global posture. The Automation Matrix axes are: stakes (low/high), reversibility (easy/hard), and volume (low/high). Internal record updates that are reversible and high-volume can be autonomous with audit logging. External emails and account deletions, which are hard to reverse and externally visible, warrant human approval. Uniform approval throws away the agent's value on safe actions; uniform autonomy creates the close calls you've been seeing. Match the gate to the action.
"Approve everything" sounds responsible but means no agent value on the high-volume safe actions. If a record update happens 500 times a day and each one requires human approval, you've replaced the agent with a queue. Match gates to stakes, not as a blanket policy.
Agent value isn't maximized autonomy — it's maximized appropriate autonomy. The close calls are evidence that current autonomy is too broad. The right question isn't "more autonomy or less" but "which actions are safe to delegate, which aren't."
Self-reported confidence is poorly calibrated, especially on the cases where the agent is most likely to be wrong — by definition, the model doesn't know it's wrong, or it wouldn't be reporting that confidence. Routing approval by confidence misses exactly the cases that need human review most. Approval gates should be based on action stakes, which are observable from outside the model.