Human-In-The-Loop Ai Gates: Dual Control for Prod-Touching Agent Tools

// policy/tool-class.ts
export type ToolClass = "read" | "write_nonprod" | "write_prod";

export const TOOLS: Record<string, ToolClass> = {
  "repo.search": "read",
  "db.query.staging": "read",
  "db.mutate.staging": "write_nonprod",
  "db.mutate.prod": "write_prod",
  "iam.putRolePolicy": "write_prod",
};

// gate/dual-control.ts
export type Approval = {
  changeId: string;          // CHG######
  blastRadius: string;       // free text, required min length
  approverA: string;
  approverB: string;
  expiresAt: number;         // epoch ms
};

export function assertDual(a: Approval) {
  if (a.approverA === a.approverB) throw new Error("same_human");
  if (!/^CHG\d{6,}$/.test(a.changeId)) throw new Error("bad_change_id");
  if (a.blastRadius.trim().length < 40) throw new Error("blast_radius_too_thin");
  if (Date.now() > a.expiresAt) throw new Error("approval_expired");
}

1. Agent requests write_prod tool with plan + blast radius draft
2. Bot posts message to #agent-prod-gates with buttons Approve/Deny
3. Approver A (not requester) Approve
4. Approver B (not A, not requester) Approve
5. Gate mints TTL capability token (5–15 min) bound to tool+args hash
6. Agent invokes tool with token; executor verifies signature + expiry

# executor/verify_token.py
def verify(token: str, tool: str, args_hash: str) -> None:
    payload = jwt.decode(token, PUB, algorithms=["RS256"])
    assert payload["tool"] == tool
    assert payload["args_hash"] == args_hash
    assert payload["class"] == "write_prod"
    # ✅ requester not in approver set
    assert payload["requester"] not in payload["approvers"]