The gate an agent cannot route around
Most “human in the loop” is a paragraph in a system prompt that the model ignores under pressure. Gatekeeper makes the gate a tool call: before an agent does anything irreversible it must ask, and a person approves or denies outside the model. It proceeds only on a yes.
Safe by default: if no human can be reached, the answer is Deny, never a silent yes. A timeout does not become permission.
The gate lives outside the model
An instruction in a prompt is a suggestion. A tool the agent must call, whose answer comes from a dialog a person clicks, is a control. The difference only matters once, and by then it has already cost you something.
The demo above is a faithful walkthrough of the approval flow, running entirely in your browser. It calls no model and sends nothing anywhere.
The actions worth stopping for
Not everything needs a gate. An agent reading a file, drafting text, or querying a database can do that all day unsupervised, and stopping it would just train people to click through.
The gate is for the small set of actions that cannot be undone by trying again.
Money
- Refunds, credits, and chargebacks
- Payouts and transfers
- Anything that creates a charge
- Changing a price or a plan
- Spending against an API budget
People
- Emails and texts to customers
- Posting anywhere public
- Calendar invites and cancellations
- Anything sent as a named human
- Escalations to a real person
State
- Deleting records or files
- Schema and permission changes
- Deploys and rollbacks
- Rotating keys and credentials
- Anything with no undo
A prompt is a request. A tool call is a control.
Almost every agent in production today is governed by a sentence in a system prompt asking it to check first. That works until the model is under pressure, mid-way through a long chain, and the instruction is ten thousand tokens behind it.
It does not care what you built with
Gatekeeper is an MCP server, so any client that speaks MCP can use it without knowing anything about the rest of your stack.
Register it
Add it to your MCP config the same way you add any other server.
Name the danger
Decide which of your existing tools are irreversible. It is usually a shorter list than people expect.
Put the gate in front
Those tools call for approval first and act only on a yes.
Watch it refuse
Test the deny path before you trust the approve path. A gate you have never seen say no is not a gate.
The obvious objections
Most of these come up in the first five minutes of any conversation about putting a human back in the loop.
Does this not defeat the point of automation?
Only if you gate everything. The value of an agent is in the ninety-odd percent of its work that is routine and reversible, and none of that gets stopped. What gets stopped is the handful of actions where being wrong costs real money, and those are exactly the ones you wanted eyes on anyway.
What happens overnight when nobody is watching?
It denies. No human reachable means no, not a silent yes after a timeout. That is the single most important design decision in the whole tool, and it is the one most systems get backwards, because failing open is easier to build and nobody notices until it matters.
Will people just approve everything without reading?
They will, if you gate too much. That is a design failure rather than a tool failure, and it is why the list of gated actions should stay short enough that every prompt is genuinely worth reading. A gate that fires forty times a day has already stopped working.
Can the model talk its way past it?
There is nothing to talk to. The approval is not a negotiation with the model, it is a return value from outside it. The agent asks, a person decides, and the agent receives an answer it had no part in producing.
Is this the whole of your agent practice?
No, it is the smallest piece of it, and the easiest to show. The AI and agents page covers the rest: orchestration, durable state, budget ceilings enforced in code, and the evaluation suites that decide whether a change is allowed to deploy.
Want this wired into your stack?
Gatekeeper is the smallest piece of how we build agent systems. The rest of the standard is on the AI and Agents page.
See the agent practice