Every agent rollout we have watched fail has failed in the same place: the approval queue. The agents were fine. The human was the constraint. Work piled up behind one person's attention, and by week three the team had quietly gone back to doing everything by hand.
At Avakata we run a dozen scheduled agents against this site and a handful of client engines, and total human review time is about 35 minutes a day. Not because we trust the agents blindly, but because we stopped approving actions and started approving classes of actions.
Here is the tiering system that gets you oversight without a queue, and the monthly audit that keeps it honest.
Why approval queues quietly kill agent leverage
An approval queue caps your agent system at the speed of one human. If your agents propose 40 actions a day and each takes 90 seconds to review, that is an hour of daily review before anyone does real work. Worse, actions wait. The median action in a queue we audited sat for 11 hours before a human saw it. The agent finished in four minutes. The human added 11 hours of latency and 90 seconds of judgment.
That latency is not just slow. It breaks the loop. An agent that publishes a fix, measures the result, and adjusts tomorrow is a system. An agent that waits half a day for permission is a suggestion box.
The queue also trains you to rubber-stamp. By approval number 30, you are not reviewing anymore. You are clicking. The oversight you kept the queue for stops existing precisely because of the queue.
So the goal is not more review. It is better-placed review.
Sort every action by blast radius, not frequency
The sorting question is not how often an action happens or how clever it is. It is two questions: how expensive is this if it is wrong, and how easily can we undo it? Cheap and reversible actions get autonomy. Expensive or irreversible ones get a human. Everything in between gets a rollback plan. Frequency is irrelevant. A daily action can be harmless and a quarterly one can be fatal.
Write the inventory down. Ours took 40 minutes: every action our agents can take, one row each, scored one to three on cost-of-error and one to three on reversibility. Thirty-one rows total.
The scores map to three tiers, and the tier decides whether a human sees the action before it happens. Not your mood that morning. The tier.
Tier boundaries are personal. A funded startup can absorb errors a bootstrapped solo cannot. Score against your own downside, not someone else's template.
Tier one: act and log
Tier one covers actions that are cheap to get wrong and trivial to reverse: drafting content that a later gate will catch, updating internal dashboards, re-running audits, tagging and filing, writing to the agent's own memory. These run with zero human involvement. The only requirement is a log line recording what ran, what changed, and where the diff lives. About 70% of our agent actions live in this tier.
The log is not decoration. Twice a month, something in it looks odd and earns a spot check. That is oversight too. It just costs minutes instead of hours.
If you feel nervous automating a tier-one action, that is usually a sign the action is mis-scored, not a sign you need a queue. Re-score it.
Tier one is also where every new action type starts its life: drafting in shadow mode until it earns the right to touch anything public.
Tier two: act, then show your work
Tier two is for actions that are reversible but visible: publishing a blog post, rewriting a meta description, adjusting internal links, changing a schema block. The agent acts immediately, then posts a diff to a review channel with a one-line rationale. A human glances at it within the day, and anything wrong rolls back in one click. You get the speed of autonomy with a 24-hour safety net.
The rollback path has to be real. Before an action class enters tier two, we rehearse the revert once. If undoing it takes more than five minutes, it is not tier two.
In June, our agents took 212 tier-two actions. Humans rolled back six. That 3% revert rate is the price of not pre-reviewing 206 things that were fine.
Publishing this post was itself a tier-two action. A human saw the diff at 4:30 and left it alone.
Tier three: hold for a human
Tier three is anything expensive or hard to undo: sending email to a client or a prospect, spending money, deleting data, changing pricing, touching anything with legal weight. These wait for explicit human approval, full stop. The design goal is to keep tier three small, under 10% of total actions, so the approvals that remain get real attention instead of reflexive clicks.
Ours currently runs at 7% of actions, roughly four approvals a day. Each gets two to three minutes. That pace is sustainable indefinitely.
Notice what this inverts. Most human-in-the-loop setups review everything and scrutinize nothing. This reviews little and scrutinizes all of it.
When in doubt between tiers, start a class one tier stricter and let the audit promote it later. Autonomy should be earned by a track record, not granted by optimism.
Batch the reviews, never interrupt
Review on a schedule, not on arrival. We clear tier-three approvals and tier-two diffs twice a day, at 9:00 and 4:30, about 15 minutes per session. Nothing pings us in between. An interruption costs 20-plus minutes of refocus, so ten real-time approvals can quietly eat half a day. Batching converts that into 30 predictable minutes, and queued actions simply carry a timestamp and execute in order once approved.
The one exception is a genuine tripwire: an error-rate spike, a spend threshold, an external complaint. Those page immediately. Everything else waits for the next session.
If a tier-three action cannot wait seven hours, ask why. Usually the deadline is imaginary. Occasionally the action is mis-tiered. Rarely is the answer to interrupt the human.
Two sessions fit our volume. At triple the action count we would add a third session before we would ever go back to real-time pings.
Audit the gate itself every month
Once a month, pull two numbers per action class: the approval rate and the edit rate. If you approved more than 95% of a class unchanged for two straight months, promote it a tier, because your review is adding latency, not judgment. If you edited or rejected more than 20%, demote it, because the agent has not earned that autonomy. The audit takes 20 minutes and keeps the tiers a living map.
June's audit promoted two classes. Meta-description rewrites and sitemap updates both moved to tier two after 60 days of unchanged approvals. It demoted one: outreach draft personalization went back to tier three after a sloppy week.
That is the whole system. The human stays in the loop exactly where the loop needs a human, and gets out of the way everywhere else.
Oversight is a budget. Spend it where errors are expensive.