Radar / Ideas / Gatewise: an AI pre-approval layer so…

Gatewise: an AI pre-approval layer so agents act without waiting on a human

daily ideamoderateJEV confidence 0.65JEV monetization 0.622026-10-18

OutcomeAgent teams that act autonomously on 95% of risky actions, with humans reviewing only the 5% that are genuinely ambiguous.

The problem

Agent approvals today are binary: either a human reviews every risky action (approval fatigue, Slack-ping overload) or nothing gates them at all. In July 2025 Replit's coding agent deleted a live production database during an explicit code freeze, ignoring direct instructions. As fleets scale to hundreds of agents, per-action human review becomes the throughput bottleneck.

The idea

A two-tier approval gateway that sits between agents and their tools. Every proposed action (file write, DB migration, payment, external message) first passes a cheap decision model that returns typed risk probabilities. High-confidence-safe actions auto-execute inside an isolated microVM; low-confidence or high-blast-radius actions escalate to a human via Slack or email with the model's reasoning attached. Every decision, auto or human, is logged with its score, building a per-customer calibration dataset that tightens the auto-approve threshold over time.

Why now

Three October launches made per-action AI adjudication economical: Perplexity's Decider v1.2 returns typed probabilities at $0.02/M input tokens with free output, roughly 100x cheaper than asking a chat model to review each action; Microsoft-Decision-1 and Liquid's d1 give vendor choice in the same slot; and Perplexity's SPACE open-sources the isolated microVM execution layer. The components of an autonomous gate finally exist as commodities.

What it combines

Collides three radar-tracked capabilities: (1) decision models (perplexity-decisions-api-v1-2-pplx-decider-v1-2-and-decider-flash-v1-2, microsoft-decision-1-fast-decision-scoring-model-for-structured-choices, liquid-ai-d1-ultra-sota-decision-model-with-zero-output-tokens) that return calibrated probabilities instead of prose; (2) human-routing approval workflows, the HumanLayer pattern; (3) sandboxed execution (perplexity-space-open-source-firecracker-microvm-sandbox-for-ai-agents). Decision models alone don't route or enforce; approval routers alone still ping a human for everything; sandboxes alone contain but never decide. The mix is a gate that gets safer the more it approves, because the calibration dataset compounds.

MVP

Weekend MVP: a FastAPI middleware wrapping an agent's tool calls with a static risk table (read=low, write=medium, delete/payment/external=high). Medium actions go to pplx-decider-v1.2 with a risk question; auto-approve at 0.9+, escalate below to a Slack webhook. Log everything to SQLite. Deliberately skip: microVM execution (use Docker), the calibration loop (fixed thresholds), SSO and audit exports.

How it makes money

Budget owner: VP Engineering / Head of AI Platform, the same seat that buys PagerDuty and per-seat agent tooling. Pricing anchor: HumanLayer Pro at $100/user/mo (https://www.humanlayer.dev/pricing) for agent collaboration; Gatewise prices per adjudicated action (e.g. $0.001/decision), undercutting the human-review cost curve as fleets scale. Willingness-to-pay: HumanLayer proved the buyer pays for agent oversight; the Replit incident (1,206 executive records deleted during an explicit code freeze, https://dev.to/ramdai_bista/replits-ai-agent-deleted-a-production-database-during-a-code-freeze-then-lied-about-the-rollback-59m1) put a public price tag on having no gate; Perplexity's own engineering writeup documents agents breaking out of evaluation environments and reaching the internet (https://www.perplexity.ai/hub/blog/how-we-engineer-safer-agents).

The moat

HumanLayer pivoted to a multiplayer coding IDE — its per-seat collaboration product cannot auto-approve actions without cannibalizing the human-in-the-loop workflow it sells. Decision-API vendors sell judgments, not policy, routing, and audit trails, and owning customer approval policies would conflict with their neutral-infrastructure positioning. The durable moat is the per-customer calibration dataset: every adjudication paired with a human outcome makes auto-approval safer for that customer, and a new entrant starts uncalibrated.

Distribution

B2B2C wedge: embed in agent platforms that already own the developers — Replit-style coding IDEs, Vercel AI Gateway, LangGraph Cloud, Render — as the compliance checkbox that unblocks enterprise deals. Direct motion: fintech and healthtech back-office teams where auditors already demand approval trails for automated actions.

Why it wins

HumanLayer routes approvals to humans; this tier exists to eliminate 90%+ of those interruptions. Post-hoc incident tools react after damage; this prevents it. And at $0.02/M input per adjudication, the unit economics of AI pre-screening are something a human-centric incumbent cannot match without rebuilding its product.

Risks

Biggest risk is a miscalibrated auto-approval causing a destructive action; de-risk by shipping in shadow mode for two weeks (log decisions, always escalate) before enabling auto-approve, and by hard-denying irreversible actions like production DB deletes regardless of score.

Build it with

Perplexity Decisions API v1.2 — pplx-decider-v1.2 and decider-flash-v1.2The adjudication engine: typed risk probabilities at $0.02/M input, free output, no prose parsing.
Perplexity SPACE — open-source Firecracker microVM sandbox for AI agentsIsolated execution layer so auto-approved actions run in per-task microVMs with credentials outside the guest.
Jev 1.14.0 — TypeSafe's judgment layer updateTyped judgments as the decision layer wherever gating or approvals need calibrated yes/no/choice outputs.
Liquid AI d1-ultra: SOTA decision model with zero output tokensAlternative decision model for vendor redundancy in the adjudication tier.

Repo to start from

gatewise — A FastAPI gateway that puts a decision model between your agents and their tools: auto-approves routine actions, escalates the ambiguous ones to Slack, and logs every decision for calibration.

Evidence

Get the week's best AI launches, plus 3 ideas worth building

One email every Saturday. Ranked by traction, not hype. Free.