Full automation is a design choice, not a goal. These are the checkpoints I keep by default.
- Anything irreversible: refunds, deletions, contract changes.
- Anything that leaves the building in your name at low confidence.
- First run of a new branch, until it has a track record.
- Edge cases the system labelled 'needs review' rather than guessed.
The interesting part is that these gates make the rest of the system easier to trust. When people know what the machine will not do on its own, they stop double-checking the things it does well.