Automation that stops for a person's yes at defined decision points, with the decision logged.
On anything that leaves the company or changes a record of consequence: emails, submissions, signatures, dispatches, payments.
Asked, then scheduled, then event-driven. Trust is earned in that order.
An approval log, a human override, source citations on every output, and a clear list of what the system cannot do.
Why the loop matters more than the model
An agent's failure mode is a plausible wrong answer delivered confidently. A workflow breaks loudly; an agent does not. The only reliable guard is a person reading the output before it matters, at the points where being wrong costs something. Designing those points well is most of the work of a safe agent, and it is why "autonomous" reads as a warning to an experienced buyer.
The loop is also how trust is built. A coordinator who approves forty drafts and corrects two learns exactly what the desk is good at. That knowledge becomes the next play.
Where the gate goes
- Anything that leaves. Emails to subs and owners, submissions to portals, dispatches to crews, anything with a signature.
- Anything that changes a record of consequence. Vendor status, a certificate marked compliant, a payment released.
- Anything with a count. Quantities on a bid, hours on a timesheet, amounts on an invoice.
What does not need a gate: reading, collecting, matching, sorting, and drafting. Those can run freely because nothing has happened yet.
Three trigger levels, in the order trust is earned
- Asked. The desk does nothing until a person hands it a job. Weeks one to four.
- Scheduled. The desk runs its plays on a cadence (every morning, every Friday) and queues the drafts. The person still approves each one.
- Event-driven. The desk reacts to arrivals (a new email, a certificate expiring in 21 days) and queues the draft. Still nothing leaves without a yes.
The gate never moves. Only the trigger does.
What to require from any vendor or builder
- An approval log: who approved what, when, and what they changed.
- A human override that a non-technical person can use: pause the queue, take a job back, correct a draft.
- Source citations on every output, so approving takes seconds instead of re-doing the work.
- A written list of what the system cannot do. If the vendor cannot name it, the system can do anything, which is the problem.
- Evidence it is running somewhere today with a person in the seat.
How a Keystone desk enforces it
A desk has no send, submit, or sign capability at all. Its output is a draft in a queue, with the sources it was built from. The person in the seat approves, edits, or rejects, and the decision is logged. The desk cannot escalate its own permissions and the gate is not a setting. Engines are held to a harder line: they never act on the world, only write to your record. More on the build in custom AI agents.