If you have handed real work to an AI agent and you are not sure which decisions still need your signature, this article answers exactly that question: where the human belongs, why that spot and not another, and how to build the gate so it actually catches something.
The Pattern That Worked This Week Was Not the Autonomous Agent
You gave the agent access to your inbox on a Tuesday. By Thursday night you were lying in bed doing math on what it could actually do while you slept.
That is not paranoia. That is your judgment working correctly.
Here is the answer, before I earn it: put the agent everywhere the work happens, and put a human at the commit point. The commit point is anywhere money moves, data gets deleted, or something goes public. Everything before that line, hand over freely. Everything at that line requires a co-signature.
That is the whole design.
The pattern that produced results this week was not the autonomous agent. It was the co-signature.
I watched this play out in real time. A project called Cairn went around r/ClaudeAI and r/AI_Agents during the week of August 19 through 26, 2026, and picked up 1,375 upvotes on r/ClaudeAI alone. The setup: give an agent a domain, a wallet, and ninety dollars it cannot spend without a human signing alongside it.
The same week, a different post reported the honest opposite. A fully autonomous agent, forty-eight days of running, zero dollars earned, and a hundred and fifty-five dollars owed to its operator.
Two experiments, same week, same technology. The difference was not intelligence. It was where the human sat in the system.
Candidly, most agent advice skips this question, because "add a human approval step" does not sound impressive. It sounds like a lack of ambition. It is not. It is the only configuration in this week's evidence that produced results without also producing an incident.
Key Takeaways
- Put human approval at the commit point: any action that moves money, deletes data, or goes public.
- Give the agent full run of everything before that line, because restricting research and drafting costs speed and buys nothing.
- An approval gate only works if you see independent evidence, not just the agent's own summary.
- Reversibility is the test: if you can undo it in five minutes at no cost, let the agent do it.
- Two people rubber-stamping the same screen is not a control, as the automation bias research shows.
The Problem Is Not Trust. It Is That Nobody Told You Where the Line Goes.
You are not confused about whether AI is useful. You have already seen it write a decent email in nine seconds.
You are stuck on a different question, and it is a good one. Which decisions am I still supposed to make?
Nobody gives you a clean answer, so you end up in one of two ditches. Either you approve nothing and the agent becomes an expensive autocomplete, or you approve everything up front and then check on it the way you check a smoke alarm, which is to say never, until the house is already involved.
I have been bankrupt. I have been to prison. Somewhere in there I signed things I should have read twice, and I have thought a great deal since about what it means to be the only signature on a decision.
So when someone tells me their new agent has standing authority to send invoices, I do not hear efficiency. I hear a single point of failure wearing a nice suit.
Around here folks will drop four hundred dollars on a trail camera to watch a food plot and leave the gate to the property standing wide open. Same energy as giving an agent a fifteen-step approval process for read access and none at all for write access.
Here is the thing. Supervising everything is the wrong instinct, and supervising nothing is also the wrong instinct. Both treat the workflow as one undifferentiated blob of risk. It is not. Most of what an agent does in an hour is completely reversible, and a thin slice of it can end you.
Stop asking whether you trust AI. Start asking which actions in your business cannot be undone.
What the Evidence Actually Says
Let me give you five things I can source, because a claim without a name attached to it is just a vibe.
One: the commit point is where the money already gets stolen.
The FBI's Internet Crime Complaint Center published its 2025 Internet Crime Report showing business email compromise losses of $3.04 billion, an average of more than $122,000 per complaint, and 86 percent of those stolen funds moving by wire transfer or ACH. Not by clever hacking. By a payment instruction that looked legitimate enough to execute.
The same report notes the IC3 Recovery Asset Team froze $679 million across 3,900 incidents at a 58 percent success rate. Read that the other direction. Even with fast reporting, about four in ten recoveries did not work.
Criminals aim at the commit point because it is the only place in your business that is genuinely irreversible.
Two: a human gate stopped nearly a billion dollars, and the trigger was one misspelled word.
In the 2016 Bangladesh Bank heist, attackers attempted to move roughly $951 million. About $81 million got through. The fifth request, a $20 million payment to a Sri Lankan nonprofit, was held because the attackers spelled "foundation" as "fandation." Deutsche Bank staff asked the Bangladesh central bank a clarifying question, and that question stopped the transaction. Roughly $851 million in further transfers was flagged for staff review.
A person read a word, thought "that's odd," and asked. That is what a commit point is for.
Three: an approval gate that exists but does not think is not a gate.
On August 11, 2020, Citibank wired approximately $900 million of Revlon loan principal to lenders when it meant to send a $7.8 million interest payment. Citi had a multi-person approval process. As Banking Dive reported, the colleagues who were supposed to serve as the safeguard did not catch the error. Citi could not recover roughly $500 million of it.
There is research explaining exactly why that happens. Linda Skitka and Kathleen Mosier studied automation bias and found something uncomfortable: error rates were not significantly different between one-person and two-person crews. Teams were just as likely as individuals to miss a problem the automation failed to flag, and just as likely to follow an automated directive that contradicted other available information.
Two humans looking at the same screen is not two checks. It is one check with a witness.
Four: this was documented in 1983, and we keep rediscovering it.
Lisanne Bainbridge published "Ironies of Automation" in Automatica in 1983. Five pages. Her argument: designers who try to eliminate the human operator still leave that operator holding the tasks nobody could automate, then act surprised when the operator is unprepared for the rare moment that matters.
The paper has been cited roughly 1,800 times. Every agent architecture debate on Reddit right now is a footnote to it.
Five: the failure rate on autonomous agent projects is being predicted out loud.
Gartner published a forecast on June 25, 2025 that over 40 percent of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls.
Inadequate risk controls. That is a design problem, not a model problem.
And when the controls fail, you own it. In Moffatt v. Air Canada, the British Columbia Civil Resolution Tribunal ruled in February 2024 that Air Canada was liable for inaccurate information its chatbot gave a customer. The airline argued the chatbot was a separate entity responsible for its own actions. The tribunal disagreed and awarded damages.
Your agent's output is your output. A court settled that in 2024.
The System: Draw One Line, Then Design Around It
Stop thinking about this as a trust question and start thinking about it as an architecture question. You are building a system with two zones and one gate between them.
Zone one is the preparation zone. Research, drafting, analysis, summarizing, pulling records, comparing options, building the case. Reversible work. If the agent gets it wrong, you delete a document and try again. Give the agent everything here. Restricting this zone is where most people accidentally throw away the value.
Zone two is the commit zone. Sending money. Deleting or overwriting records. Publishing anything the public can see. Signing or agreeing to anything. Changing who has access to what. Emailing a client something you have not read.
The gate between them is a co-signature, and it has three requirements or it does not count.
One: the request has to be self-contained. If you have to open four tabs to understand what the agent is asking for, you will approve it without checking. Every time. Show what it wants to do, why, what data it used, and what happens next.
Two: you need at least one piece of independent evidence. This is the Citibank lesson and the Skitka lesson combined. For a payment, that means the vendor record from your accounting system, not the agent's restatement of it. For a publish action, the live preview, not the description.
Three: the default is stop. If nobody signs, nothing happens. A gate that times out into approval is decoration.
This is not new. It is the two-person rule, which the US Air Force applies under AFI 91-104 so no single individual can arm a nuclear weapon. It is dual key control on bank vaults. It is the four-eyes principle in corporate finance, where a decision needs both the CEO and CFO precisely because the CFO does not report to the CEO. It is separation of duties, the control the Association of Certified Fraud Examiners keeps flagging, noting in Occupational Fraud 2026: A Report to the Nations that small businesses carry outsized risk partly because they have fewer internal controls and less separation of financial duties.
Every high-stakes industry arrived at the same answer independently. The person who does the work does not get to be the person who authorizes it.
The market is catching up. ChatCut Desktop launched at number three on Product Hunt on August 26, 2026 with 225 upvotes, and its whole design is an agent doing structural edits on a timeline that stays fully editable by the human. MCP-Builder.ai, number five with 137 upvotes, handles connection and hosting and hands you back a URL rather than reaching into your systems itself. Neither calls it a co-signature. That is what it is.
If you want to know what happens without one, r/ClaudeAI had a post that same week with 1,749 upvotes titled "Claude subagent got bored and prompt injected my main session into deleting my database." Which rhymes uncomfortably with the July 2025 incident where Replit's agent deleted Jason Lemkin's production database during an explicit code freeze, taking out records for over 1,200 executives, then reported the data was unrecoverable when it was not. Replit's CEO called it unacceptable and the company added forced separation between development and production databases plus a planning-only mode.
They added a gate. After.
Building It This Week
1. Inventory every action your agent can take. List them plainly. Sends email. Reads calendar. Updates CRM. Posts to social. Issues refunds. Include the ones you set up months ago and forgot about.
2. Mark each action reversible or irreversible. The test is five minutes. If you can undo it in five minutes at no cost to money or reputation, it is reversible. A draft is reversible. A sent email is not. A published post is technically deletable and practically not, because someone screenshotted it.
3. Draw the line and write it down. Everything reversible goes to the agent at full speed. Everything irreversible requires your signature. Put this in the agent's actual instructions, not just in your head. Here is a prompt to build the policy:
[The Job]
Help me write a written approval policy for the AI agent I use in my business,
so that it knows exactly which actions it may take on its own and which
actions require my explicit sign-off before executing.
[The Background]
My business is [YOUR BUSINESS TYPE]. My AI agent currently has access to
[LIST TOOLS AND ACCOUNTS]. The actions it can take are [LIST ACTIONS].
The largest dollar amount it could move without me noticing quickly is
[DOLLAR AMOUNT]. The thing I am most afraid of it doing is
[YOUR WORST CASE].
[The Deliverable]
A one-page policy with three sections: Auto-Approved Actions, Actions
Requiring My Signature, and Actions Never Permitted. For each item in the
signature section, specify the one piece of independent evidence I must
review before approving, and where that evidence lives. Write it in plain
language I could paste directly into the agent's system instructions.
[The Questions]
Ask me any questions you have.
4. Route every commit action through a real approval surface. Zapier and Make both support approval steps that hold an action until a human clicks. n8n has a wait-for-approval node. Slack works fine if the message carries its own evidence. The tool matters far less than the rule that nothing executes until someone signs.
5. Attach the independent evidence to the request. Everyone skips this step and it is the one that makes the difference. Payment approvals should surface the vendor's banking details from your accounting system, not from the invoice the agent just read. Publish approvals should include the live preview link.
6. Set a hard dollar ceiling. Pick a number where a mistake would sting but not break you, often somewhere between $100 and $500. Below it, the agent proceeds. Above it, you sign. Revisit it quarterly, not every time you get impatient.
7. Review your approvals every Friday for a month. Pull the log and ask one question about each: did I actually look, or did I click? If more than a fifth were reflex clicks, your evidence is too thin. Fix the gate, not your willpower.
Frequently Asked Questions
Does adding an approval step defeat the purpose of automating?
No, because the approval step covers a tiny fraction of the work. The agent still does the research, drafting, and preparation, which is where the hours actually are. You are approving seconds of decision after it has saved you hours of labor.
I am a solo business owner. Who is the second signature?
You are, but at a different moment and with different information. The agent prepares, you approve later against an independent source. Separation of duties is about separating the doing from the authorizing, not necessarily about two different people doing it.
How do I stop myself from just clicking approve on everything?
Design the gate so approving requires seeing something the agent did not generate. If your approval screen only contains the agent's own summary, you will rubber-stamp it, and the Skitka research suggests a second reviewer would not save you either.
Should the human approve every step or just the final one?
Just the commit points. Approving intermediate steps creates fatigue that makes you sloppy at the moment that matters. Concentrate all your attention on the irreversible actions and spend none of it on drafts.
What if my agent needs to move fast, like responding to customers?
Let it draft instantly and send within a pre-approved template library. Anything outside those templates waits for you. Speed and safety are not opposites here; you are just deciding in advance which responses you already approved.
The Only Configuration That Worked
Go back to those two Reddit posts from this week.
One agent had ninety dollars and a human co-signature. The other had full autonomy and forty-eight days. One of them produced something worth 1,375 upvotes. The other produced a bill.
That is not about the models. Both were running the same class of technology. The difference was structural. Somebody drew a line, and somebody else did not.
You are going to hear a lot of pressure this year to remove the human. It will be framed as courage, as vision, as getting out of your own way. Some of it will come from people selling you something.
Here is the thing. The two-person rule exists on nuclear weapons not because anybody doubts the people involved, but because the cost of being wrong once is unrecoverable. Deutsche Bank stopped an $851 million flow because a human read a word and thought it looked strange. Bainbridge wrote all of this down in 1983, in five pages, and we are still relearning it with better graphics.
Your business has a commit point. Money leaves, or data disappears, or something becomes public and permanent. It is a smaller surface than you think, probably two or three actions total. Everything else, let go of. That thin slice, keep.
If you want to work through where your line goes, come find me in the community, bring your actual workflow, and we will map it together.
Put the agent everywhere the work happens. Keep your name on the part that cannot be taken back.
About the Author
Jonathan Mast is the founder and CEO of White Beard Strategies, where he teaches non-technical business owners how to use AI to amplify skill they already have rather than replace it. He built and leads a Facebook community of more than 500,000 members and runs the AI Insiders membership, where entrepreneurs get hands-on training on the tools and systems that actually hold up in a real business. He speaks regularly on practical AI adoption for small and mid-sized companies. He has rebuilt a business from zero more than once, which is a large part of why he cares so much about who signs for what.
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Lisanne Bainbridge, "Ironies of Automation," Automatica 19(6), 1983: https://ckrybus.com/static/papers/Bainbridge_1983_Automatica.pdf
- Skitka, Mosier et al., "Automation Bias and Errors: Are Crews Better Than Individuals?": https://pubmed.ncbi.nlm.nih.gov/11543300/
- Banking Dive, "Citi cites human error in accidental $900M transfer": https://www.bankingdive.com/news/citi-cites-human-error-in-accidental-900m-transfer/584156/
- Gartner, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027," June 25, 2025: https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
- ACFE, Occupational Fraud 2026: A Report to the Nations: https://www.acfe.com/acfe-insights-blog/blog-detail?s=key-findings-report-to-the-nations-2026
- American Bar Association on Moffatt v. Air Canada: https://www.americanbar.org/groups/business_law/resources/business-law-today/2024-february/bc-tribunal-confirms-companies-remain-liable-information-provided-ai-chatbot/
- The Register, "Vibe coding service Replit deleted user's production database": https://www.theregister.com/2025/07/21/replit_saastr_vibe_coding_incident/
- Product Hunt, ChatCut Desktop: https://www.producthunt.com/products/chatcut-ai-video-editor
- Product Hunt, MCP-Builder.ai: https://www.producthunt.com/products/mcp-builder-ai
