ADPS Agent Design Pattern White Paper

G1 · Approval Gate

Freeze the approval object and prove that resumed execution still matches it.

Approval Gate runs before a high-risk action becomes effective. Its input is a concrete intent made of an immutable tool version, canonical arguments, resource scope, delegated identity, and business preconditions.

Coordinate and boundary

Governance × Route. The same tool can reach deny, allow, or ask according to principal, arguments, environment, impact, and reversibility. Action generation belongs to the Action module; G2 bounds impact after admission.

Three records

Record	Contents	Constraint
Intent	Agent, run, tool digest, arguments, resources, policy version, preconditions	A material change creates a new intent
Approval	Reviewer, decision, basis, expiry, use count, intent digest	One decision refers to one explicit object
Execution	Revalidation, idempotency, actual call, state delta, external receipt	Proves execution matches approval

intent:
  tool_digest: sha256:4ef...
  parameters_ref: artifact://intent/int_01/params
  resource_scope: {tenant: tenant_42, max_records: 20}
  policy_version: payroll-v12
  preconditions: {ledger_version: 417}
approval:
  intent_digest: sha256:93a...
  expires_at: 2026-08-19T09:30:00Z
  max_uses: 1
execution:
  idempotency_key: payrun-2026-08-batch-17

Canonicalize arguments before hashing. Field order, defaults, time zones, and numeric precision otherwise make identity comparison unreliable.

Ordered decisions

Deterministic rules handle hard denial, explicit admission, and mandatory review.
A model classifier adds context and rationale but does not issue authority.
A policy engine joins identity, arguments, resources, and environment into a structured verdict.

Conflict order is part of policy. A high-risk path normally stops when policy or review is unavailable.

Pause and resume

DRAFT → EVALUATING → DENIED
                  ↘ ALLOWED → EXECUTING → CONSUMED
                  ↘ PENDING → APPROVED → REVALIDATING → EXECUTING
                                      ↘ EXPIRED / INVALIDATED

Resume checks the intent digest, tool and policy versions, expiry, single-use state, and material preconditions. The domain decides which changes invalidate approval.

Running example

A payroll agent prepares an 18-person batch. Policy finds a changed payee account and shows the account diff, total, source ledger, and reason. Another amount changes during review. The old approval is invalidated, a replacement intent is reviewed, and the new approval is consumed atomically. The payment receipt and state delta complete Execution.

Failure and verification

Common failures include approving only a tool name or prose summary, omitting expiry and single use, allowing model risk scores to issue authority, bypassing the gate on retry or resume, and hiding parameter or resource differences from reviewers.

Test tampering, policy change, expiry, concurrent consumption, duplicate callbacks, precondition change, and review-service failure. Monitor approved-versus-executed digest equality, stale-approval rejection, high-risk bypass, and unnecessary low-risk review.

Related specifications

G2 bounds impact; G3 supplies capability autonomy; X1 links the three records; G5 enforces pre-call and resume checks.

Suggested citation:ADPS, G1 · Approval Gate, Agent Design Pattern White Paper v0.4, 19 August 2026.

Pattern catalog · Governance workshop · CC BY 4.0

Scope:Public review draft. Definitions and classifications are open for discussion and citation; running examples explain mechanisms, while attributed practice appears in the case library.