Per 1,000 tasks, 20,000 simulated tasks per policy; 93.5 harmful actions in total:
Policy
Requests per task
Catch probability (fatigued)
Harm leaked, fatigued
Harm leaked, full attention
Good actions rejected
none
0
n/a
93.5
93.5
0
all
6.0
0.23
70.8
9.5
120
irreversible
1.8
0.47
60.4
29.2
35
risk score >= 0.5
1.0
0.60
45.1
22.3
19
irreversible or risk >= 0.7
1.9
0.46
57.0
19.5
38
Harmful actions leaked under five gating policies, with and without fatigue, and time to finish 50 tasks with blocking and non-blocking waits.
Load (harm leaked per 1,000 tasks, gate-everything / irreversible-only): at 2 tasks per hour 39.9 / 39.4; at 10, 70.8 / 60.4; at 40, 86.7 / 79.4.
Blocking against pausing (minutes to finish 50 tasks, one worker, 5 minutes of work each): mean wait 5 minutes: 486 against 250; 30: 1,663 against 272; 120: 5,904 against 713.
Reading it:
Gate-everything is the best policy only for a reviewer with unlimited attention. Under my fatigue assumption it is nearly as bad as no gate (71 of 94 leaked).
Fewer, better-targeted requests win under load, and the gap grows as load grows.
The risk-score gate did best under fatigue but only because the score is informative by assumption. Treat it as a hypothesis to test on your own data, not a result.
Targeting has a floor. Irreversible-only never sees reversible harm (0.5 percent per action), which is why it leaks 29 even with full attention.
Pausing, not waiting, keeps throughput. The pause costs durable state; the gain grows with the wait.
A time limit is a design choice. At a 30-minute mean wait, 36.8 percent exceed 30 minutes, 13.5 percent exceed 60 and 1.8 percent exceed 120.
Design rules
Classify tools by consequence (read-only, reversible, irreversible, costly) and gate the top class; review the classification as tools change.
Measure the gate: approval rate, edit rate, time to decide, and harm found in sampled auto-approved actions. A rate above 95 percent suggests over-flagging; check by sampling.
Make the request readable: the action, its arguments, the reason, the evidence, the undo path and the choices (approve, edit, reject, ask).
Pause durably and free the worker; resume by id on any worker.
Default on timeout is stop or re-plan, and long pauses are re-validated (module 7).
Ask in the interface that fits: a short, specific question beats a generic "continue?"
Keep an audit log of who approved what and when.
Reduce gates as evidence accumulates, keeping spot checks (executor to reviewer to governor).
Enforce the gate in code (a hook or the tool wrapper), not in the prompt; a prompt can be talked out of it (Level 10).