How Do Human-in-the-Loop Approvals Work in Gate?

When an agent requests an action that violates an automatic threshold (or requires explicit sign-off), Gate puts the execution in a deterministic pending state and alerts human operators.

How does an approver review an agent action? 1. **Push Notification**: Gate sends an approval alert via Slack message, webhook payload, or dashboard notification. 2. **Context Inspection**: The approver inspects the full context: the originating agent ID, the exact target API call, parameter diffs, and the prompt reasoning trace that produced the request. 3. **One-Click Decision**: The approver clicks `Approve` or `Deny` with an optional note or parameter adjustment. 4. **Resumption or Abort**: - If approved, Gate signs the request cryptographically and forwards the tool call to the destination endpoint. - If denied, Gate aborts execution and returns an error response to the agent explaining that the action was rejected.

What happens if an approval times out? Every pending approval has an expiration policy (defaulting to 15 minutes). If no designated human responds within the timeout window, Gate defaults to `denied` (fail-safe close) and logs a timeout event on the audit ledger.

Verification Sources - Human approval worker: `sonnev-gate/apps/dashboard/src/app/api/approvals/route.ts` - Webhook signature and timeout rules: `sonnev-gate/packages/core/src/policy.ts`