Designing Approval Gates for Gov Agents

A file-noting agent in a directorate was set to 'assist'. It drafted. It also advanced the e-file to the next officer because someone had ticked auto-route to save clicks. Deputies began seeing notes they had not asked for, already sitting in their queue, with the previous officer's name attached because the agent had guessed a sign-off. Two weeks later a sensitive annexure had been seen by a desk it should not have reached. The CIO was asked to 'add a human in the loop'. The loop had been there. The gate had not.

This is a design guide for CIOs, NIC leads and process owners. A gate is not a philosophy. It is a stopped action, a named role that may release it, a reject that returns the work without pretending it was approved, and a seven-field trail. Build gates where power sits — DFPRs, local delegations, and the Manual of Office Procedure habit of your secretariat — not where the vendor's UI had a spare checkbox.

Not legal advice. Not a BPMN standard. Fit the gates to your e-office, not the other way around.

Four kinds of action, four default gates

Internal draft: the agent writes a noting or a reply inside the officer's workspace. Default gate: none to create; a gate to send onward. The draft is a suggestion until a human moves it.

Internal retrieve: the agent reads a circular or a table. Default gate: allow-list of classes, not a click per retrieve. Log the class. A click per retrieve will be skipped and then you have no log either.

External speech: SMS, portal, letter, email to a citizen or another body. Default gate: named process owner. The department is speaking.

Commitment: sanction, rejection of a benefit, change to an entitlement register, a GeM order. Default gate: the competent authority under the live delegation. No guesses. No auto-route.

Defaults you can argue with. What you cannot do is leave the cell blank and hope the model is careful.

Action class	Default gate	Log
Draft in workspace	No gate to create; gate to forward	Who, output hash, override if edited
Retrieve public circular	Allow-list, no click	Tool + data class + why
Retrieve personal / financial class	Purpose tag + allow-list; extra gate if leaving the zone	Class, purpose, who
Citizen-facing send	Process owner	All seven fields
Money / benefit / register change	Competent authority (DFPR or local)	All seven + delegation reference

Auto-route is not a kindness

E-office auto-routing already causes accidental exposure when humans do it. An agent that auto-routes multiplies the error and removes the pause in which a human would have noticed the wrong desk. If you want speed, give the officer a one-click forward after they have seen the draft. Do not let the model choose the next inbox.

The Guidelines' People First sutra is useful here as a design test: did a person who owns the consequence get a real look? Innovation over Restraint is useful as the opposite test: are you adding gates that nobody will use, creating a rubber stamp? Both tests, not one.

Reject must be a first-class path

If the only buttons are Send and Edit, tired officers will Send. Add Reject, add Return to drafter, add Escalate. Log them. Measure the reject rate. A zero reject rate after a month is not excellence. It is a loop that has become furniture.

Put the gate in the same system that holds the record. A WhatsApp 'ok' is not a gate. See the audit-trail piece in this cluster.

• Stopped by default on commitment and external speech.
• Named role, not 'any logged-in user'.
• Reject / return / escalate, each logged.
• No model-chosen next inbox.
• Delegation reference on money and benefits.

Buy the gate, not the slide

In the RFP, require a configuration that binds actions to directory roles, a dry-run that shows a stopped sanction, and a sample trail. If the product can only do 'HITL on/off', it is not ready for a secretariat.

Ask the vendor to fail on purpose in staging: a clerk account tries to release a sanction; a tool not on the allow-list is called; a file is forwarded to a role that must not see it. If those three attempts succeed, you do not have gates. You have labels. Labels do not survive a CAG reconstruct or a writ.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Gates will destroy the time we hoped to save.

Gates on commitments save the time you would spend on a wrong sanction. Leave drafts ungated. Gate the acts that have power. That is how you keep Innovation over Restraint from becoming Innovation over Arithmetic.

Our e-office cannot take a third-party gate.

Then the agent stays in a side workspace and a human pastes. Ugly and correct beats a silent integration that auto-routes. Integration is a project with its own security annexure.

Competent authorities will not sit on a queue.

They already sit on a queue. The agent should shorten the draft, not the authority. If the volume is impossible, you have a delegation design problem, not an AI problem.

We will add gates after we see how it behaves.

After is how the annexure leaked. Start closed on commitment and speech. Open later with a note.

Stage the three fails before anyone calls it live

A gate that has never been failed in staging is a rumour. Before go-live, sit the CISO, the process owner and one competent authority in front of three scripted attempts. A clerk account tries to release a sanction. The agent is asked to call a tool that is not on the allow-list. A file with a restricted annexure is offered to a role that must not see it. Each attempt should stop, log, and leave a reconstructable record. If any attempt succeeds, you are not live. You are leaking with a banner.

Photograph the stopped screens — or better, export the seven-field records — and put them behind the note. A later officer who wants to 'just turn auto-route on for a week' will have to argue with paper. Paper is how gates survive the first backlog.

Repeat the three fails after every material upgrade: new model hash, new tool, new directory sync. Upgrades are how gates die quietly. The charter's review date is not enough. The fail pack is a release criterion, like the isolation soak.

A two-week gate map

CIO + process owner + DPO + one competent authority in the same room. The agent architect does not get a vote on who holds a power.

1. Week 1: inventory actions into the four classes. Bind roles from the directory and the delegation orders.
2. Week 2: configure stops, reject paths, and trail. Dry-run a wrong-desk attempt and a refused sanction. File the screenshots.

How this shows up in the file

Attach the action-to-gate table and the dry-run. The note says auto-route is off for the agent, commitments require the competent authority, and reject rates will be reported monthly.

If the product cannot bind a directory role to a stop, it is not the product.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How this survives CAG, RTI or the Board

“Designing Approval Gates for Gov Agents” is not a workshop slide. A P1 CIO/CTO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

A gate is a stopped action, a named role, a reject path and a log. If the agent can send without that, you do not have a workflow. You have a hope. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “AI approval workflow government” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Designing Approval Gates for Gov Agents” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI approval workflow government” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.