Approval gates are the primary mechanism for maintaining human oversight in otherwise autonomous workflows. They are typically placed before irreversible or high-risk actions: merging code to a protected branch, deploying to production, sending external communications, or making database changes. The gate converts a fully autonomous flow into a supervised one at the points that matter most.
Gates can be synchronous (the workflow blocks until approval arrives) or asynchronous (the workflow notifies a reviewer and resumes when approval is recorded). Asynchronous gates are more practical for long-running agent workflows that might otherwise leave human reviewers waiting.
The effectiveness of an approval gate depends on what information is presented to the approver. A gate that shows only 'agent wants to merge PR #47' provides less useful oversight than one that shows the diff, the test results, the risk score, and the agent's reasoning. Approver fatigue — rubber-stamping gates because they fire too frequently or provide too little context — is a real failure mode that reduces gates to security theater.