Where the loop actually is

What it is, and what it is not

A structural gate between the Prepare and Execute permission tiers, plus a short list of acts that remain human regardless of how an agent is configured.

It is not a review queue where somebody rubber-stamps agent output. A queue of things to approve, presented without the evidence behind them, produces approval at the rate the queue arrives — which is oversight in form and nothing in substance.

It is also not a claim that a person checks everything. Most agent work is reading and explaining, and requiring a human signature on an answer to a question would make the feature useless. The loop is placed where consequence is, not everywhere.

The mechanism: the gate is a tier boundary

Agents sit on one of four rungs per tool per tenant. Observe reads. Recommend proposes with citations. Prepare creates real objects in an unsubmitted state. Execute commits inside a policy you wrote.

The gate is between Prepare and Execute, and crossing it requires a human approval. That placement is the whole design: at Prepare an agent has done the assembly work — the affected objects populated, the reviewers recommended, the draft written — and a person supplies the judgement and the accountability.

Most tenants stop at Prepare, and that is the intended destination rather than cautious under-adoption. A drafted ECR with its impact set already populated is most of the labour; a person submitting it is a feature, because submission is where responsibility attaches.

What makes the review real rather than ceremonial is that every element of a draft carries a citation. A recommended reviewer names the release they signed. An affected object names the relationship path and depth by which it was reached. The reviewer can disagree with the reasoning rather than only with the conclusion.

Four things no tier ever grants

Approval. An approval is a signed statement by a named person with a recorded meaning. An agent cannot be an approver at any tier, because the value of an approval is precisely that a person's judgement and name are attached to it.

Setting effectivity. How much stock to burn through, what a customer has been promised, when a plant can absorb a change — none of that is in the data, and an agent choosing a date would be guessing about money and commitments.

Deciding disposition. Use-as-is, rework, scrap and return-to-vendor are judgements made with inventory in front of somebody who owns the consequence. The agent assembles the context and stops.

Merging parts. A wrong merge is close to unpickable: two genuinely different parts become one and the record of which was which is gone. Consolidation is proposed with evidence and executed through change control by a person.

The failure it prevents

An organisation enables agents broadly because the demos were good and the drafts were consistently sensible. For six weeks nothing goes wrong, and the reviews get faster — which reads as the team gaining confidence.

What is actually happening is that the reviews are getting shorter. A reviewer who has approved forty correct drafts approaches the forty-first differently, and the forty-first is the one where a taxonomy edit changed what a rule matched and nine hundred parts are in scope.

The gate does not prevent that by making people vigilant, which nothing does. It prevents it by ensuring the forty-first draft is still a draft — so the failure is a bad proposal somebody eventually notices rather than nine hundred reclassified parts and a rollback conversation.

How it meets your ERP

Publication to a production ERP sits at Execute by default and is a stated constraint in the connector configuration rather than a toggle. No chain of agent hand-offs and no phrasing of a request reaches it from a lower tier.

That is the sharpest version of the gate, because publication is the point at which an engineering record starts driving purchase orders. An agent that could publish would be an agent that could cause procurement to act, and the human approval that authorises a release is what makes that acceptable.

ERP-mastered fields are read-only beneath every agent regardless of tier, so the gate is not the only control there — an agent at Execute still cannot write a cost, because ownership is enforced below the tier system entirely.

Where the boundary is

A gate bounds consequence; it does not improve judgement. A reviewer who approves without reading has produced a worse outcome than no agent at all, because the draft carried an implication of diligence that was not exercised. Citations exist to make reading cheap enough to actually happen.

It also does not scale linearly. An organisation approving four hundred agent drafts a week has moved the bottleneck rather than removed it, and the honest answer at that volume is to raise specific agents to Execute within a narrow policy rather than to review everything badly.