Approval gates.

The claim.

An AI agent in a business should be allowed to do everything that can be undone and nothing that cannot. Reading, classifying, drafting, filing, reminding and reporting can be undone: a wrong draft is discarded, a wrong label is moved. Sending a message, moving money, submitting a filing and deleting a record cannot be undone by the business alone; they involve someone else. Those four wait for a person.

This is the whole model. The rest of this paper is how it is built, what it costs and what it looks like after a year of running it across the systems on the build library.

Why not trust the agent.

Not because the models are bad. The reply desk classifies correctly in the high nineties; the bill reader lands the right account most of the time; the morning report has not misreported a figure since the row references were added. The gate is there for the residual: the one reply in fifty that answers the wrong question to the wrong person, the one bill in a hundred that is a duplicate, the one deletion that a dependent record needed.

A business can absorb a wrong draft. It cannot absorb a wrong email to a client, a double payment or a filing it did not mean to make. The cost of the gate is a person’s minute per gated action. The cost of the residual is the relationship, the money or the regulator.

The four gates.

Outbound: every message to someone outside the company, on any channel. Money: payments, refunds, credit notes, price changes. Filings: submissions to a regulator, a bank, a tax authority or a platform. Deletion: removal of any record another record depends on.

Each gate has an approver role. A person can hold several roles. An agent can hold none, ever. The approval is one action in the queue, logged with the person’s name and the moment. The agent prepares everything up to that action and nothing past it.

The queue.

Gated actions land in a queue the approver works through in the tools they already use: the draft is in the mail thread, the bill is in the ledger as a draft, the file is ready to upload. The queue is a view, not a new system. An approver sees what the agent proposes, the evidence it used and one action to approve or discard.

Queues are sized to the person. A reply desk that produces 40 drafts a day for a person who can review 60 is fine. One that produces 400 is a sign the gate should narrow (auto-file the acknowledgements, gate the substantive replies) or the team should grow. The log shows the throughput, so this is a number, not a feeling.

The log.

For every agent action, gated or not: the input read, the prompt and model used, the output, the time, and for gated actions the approver and the moment of approval. A figure on a report carries the row references it was computed from. The log is in the client’s account and readable without KYN.

Three things the log makes possible that nothing else does: tracing a wrong figure to its rows in a minute, measuring the approval rate per workflow so a gate can be lifted on evidence, and answering a regulator or an auditor with the record rather than a reconstruction.

Caps and the kill switch.

Daily cap on outbound volume per sender (45 emails a day on the sales agents). Spend cap per model key. Rate limit per public endpoint. A kill switch per agent that stops it in one action, held by the client, not by KYN.

Caps are set in advance and raised in writing. The kill switch has been used twice across the live builds: once for a mailbox migration, once because an upstream API started returning stale data. Both times the queue held and the people kept working.

Lifting a gate: the 30-day rule.

A client can move an action from gated to autonomous, in writing, for one named workflow, after the agent has run gated for at least 30 days with its approval rate reviewed. Internal reminders and reports are autonomous from day one. Nothing in the money, filings or deletion gates has been lifted on any live build as of October 2026; one outbound workflow has (acknowledgement replies on a shared enquiries mailbox, after 94% of drafts were approved unchanged for six weeks).

The rule exists so that the decision is the client’s, is on the record, and is made on a number.

What it costs.

The gate costs a person’s minute per gated action. The reply desk at 40 drafts a day costs about 40 minutes of a desk owner’s time, against the two to three hours the same replies took to write. The finance desk at 30 bills a week costs an approver 20 minutes a week. Nothing here removes a job; it removes the typing.

The agent’s own cost is the model and messaging fee per unit at list prices, published on the build library for every system: S$0.01 per reply sorted or bill read, S$0.05 per AI search check, S$0.06 per article. Hosting is S$0 to 60 a month per system at SME volumes.

Failure modes, designed for.

Wrong classification: the message lands in the wrong queue; the next review catches it. Wrong draft: edited or discarded before sending. Wrong figure: traced to its rows through the log and corrected at source. Model outage: the agent stops, the queue holds, the people keep working in the same tools; the queue resumes when the provider returns. Prompt injection in an inbound message: the agent can only draft, file and flag, so the worst case is a strange draft a person discards.

The failure mode the model does not cover is a person approving without reading. The log shows approval time per item; a run of two-second approvals is flagged to the desk owner.

Evidence.

21 live builds run under this model as of 13 October 2026, listed on the build library with their pipeline, stack, run cost per unit and build time. The ones that touch the four gates most: