Approvalsan agentcannot forge

Gate 01 / 07The trigger

Two bookings, no yes.

13 October 2026: our management system is connected to the company OS. That same day, an agent books two cash payments directly. No rule had required it to ask first.

Gate 02 / 07The old principle

The agent can set a flag itself.

That is how our delete confirmation worked: after the yes, the agent adds a marker to its command. No program can check whether the person really agreed.

Gate 03 / 07The new principle

It cannot write the person’s sentence.

Before every booking, a hook reads the last message a human wrote. Only if the agreed sentence is there does the curtain open.

Gate 04 / 07What does not count

A “yes” is not a sentence.

Nor does an answer to a multiple-choice question, pasted text from elsewhere, a summary, or anything the agent says itself.

• “yes”
• “do it”
• Choice answer
• Pasted text
• Summary

Gate 05 / 07The levels

Locks follow consequences.

Where nothing can go wrong, the way stays open. Otherwise the team would soon type the sentence out of habit alone.

• Reading, logging time open
• Drafts one click
• Money and master data fixed sentence
• Send, sign, delete does not exist

Gate 06 / 07The mechanics

One sentence, one booking.

The hook keeps count. Two payments need the sentence twice, otherwise the second one stays put. When in doubt, the curtain stays closed.

1:1Sentence and booking

Gate 07 / 07The limit

A curtain, not a lock.

The hook catches an agent’s mistakes. The hard limit lies deeper: sending, signing and deleting do not exist in the agents’ toolset at all.