Key takeaways
- The designer scores consequence, reversibility, uncertainty and affected scope, then applies hard stops for critical or irreversible high-consequence actions.
- Its output is a design prompt, not permission to deploy. Legal duties, internal policy and the actual rights of affected people can require stricter control.
- The exported contract names the placement, reviewer, evidence packet, outcomes, deadline, escalation and resume rule rather than returning a vague risk label.
- Everything runs in your browser. No input is submitted, no account is needed and the recommendation changes immediately as you change assumptions.
Design one approval gate
Suggested control · score 7
Deterministic checks plus exception approval
Pause immediately before the exact effect, after the proposal and source evidence are complete.
Evidence packet
- Exact proposed action, target and normalized payload
- Original source records and relevant before-state
- Named policy rule, threshold or reason the request was routed
- Known uncertainty, plausible consequence and safe alternative
- Final recipient, destination and externally visible wording
Allowed outcomes
- Approve the exact proposal
- Edit and create a new proposal version
- Reject with a reason
- Return for more evidence
- Cancel
- Expire safely
Show the scoring rationale
- moderate consequence contributes 2 points.
- partial reversibility contributes 1 points.
- bounded judgment contributes 1 points.
- external person contributes 2 points.
- External effect adds 1 point.
How the recommendation is calculated
The tool uses a deliberately inspectable heuristic. Consequence adds 0, 2, 4 or 6 points. Reversibility adds 0 for complete rollback, 1 for partial repair and 3 when the effect cannot be recalled. Rule-based, bounded and open judgment add 0, 1 and 2. Affected scope adds 0 through 3. External effect and sensitive data add one each.
Scores up to four suggest a bounded automatic path with post-action sampling. Five through seven suggest deterministic checks plus approval for exceptions. Eight through ten suggest blocking approval. Critical consequence, irreversible high-consequence action or a score of eleven or more produces the strictest result: two independently authorized reviewers or prohibition.
| Result | Default runtime behavior | Evidence needed before relaxing it |
|---|---|---|
| Automatic with sampling | Execute inside fixed bounds, retain rollback and review a stratified sample | Low sampled miss rate and complete, tested reversal |
| Exception approval | Code passes the normal path; named ambiguity or threshold pauses | Stable trigger coverage and useful reviewer interventions |
| Blocking approval | Pause the exact effect until an authorized decision arrives | A safer bounded path proven by production sampling |
| Two people or prohibit | Require independent authority or do not make the action available | Governing policy and qualified review, not a lower model score |
Why the tool asks about the effect instead of model confidence
NIST's AI RMF connects oversight to context, likelihood, impact and risk tolerance. Google Cloud recommends human involvement for high-stakes decisions, safety-critical work and subjective approval. Both point to the action around the model, not a confidence number in isolation.
A confidence estimate can help route bounded cases when it has been calibrated against similar deployed work. It cannot decide whether a public message, access grant or decision about a person is authorized. That is why the designer asks what happens if the action is wrong, who is affected and whether the effect can be reversed.
Use the copied specification as a review prompt
- 01Challenge the classificationAsk the process owner, control owner and affected operator whether consequence and reversibility include downstream use, disclosure and delay.
- 02Replace generic evidence with real fieldsName the source record, before-state, policy clause, recipient, diff and safe alternative the reviewer will actually see.
- 03Verify authority and expiryConfirm the named role can refuse, define coverage when they are absent and make expiry land in a safe owned state.
- 04Implement the state machineUse the approval workflow patterns to bind the proposal and resume exactly once.
- 05Test and measureTry altered, expired, unauthorized and duplicate decisions. Then track coverage, interventions, expiry and sampled misses rather than approval volume alone.
Example interpretation
The default action has moderate consequence, can only be partly reversed, needs bounded judgment, affects an external person and sends externally. It scores seven, so the tool suggests deterministic checks plus exception approval.
That result is useful only after the team defines the normal path. A templated acknowledgement with no promise may pass automatically. A message that names a cause, compensation or recovery time becomes the exception and waits for the service owner. If every status update makes a public commitment, select the wider affected scope and use blocking approval instead.
Limitations and when not to use this
- The score is an educational design heuristic, not a risk assessment, legal classification, security review or authorization decision.
- It does not know your laws, contractual duties, internal policies, reviewer competence, model calibration or actual failure history. Any of those can require a stricter control or prohibit the action.
- Browser inputs are not submitted to all-agents, but avoid entering confidential records into any planning tool. Describe the action and role, not a real customer, employee or credential.
Sources
- AI Risk Management Framework Core — NIST Accessed 30 July 2026
- Choose a design pattern for your agentic AI system — Google Cloud Architecture Center Accessed 30 July 2026
- Regulation (EU) 2024/1689, Article 14 — EUR-Lex Accessed 30 July 2026
Implement the runtime states
Take the copied specification and map it to durable pending, approve, edit, reject, expire and resume transitions.
Implement the runtime statesUli Prantz
Builds and operates all-agents
Uli Prantz builds all-agents, the process-automation platform this site documents. He writes about the operational side of automating recurring business work: where deterministic code beats model judgment, where it does not, and where a human still has to approve.