Autonomy Is Only as Safe as Its Gate
I hand real work to software that runs while I sleep. Content sites that edit and publish themselves. A commerce backend that delists a sold card across four marketplaces on its own. A finance system that reconciles a shop's books overnight. None of it asks my permission before it acts.
The thing that lets me sleep through all of it isn't trust. It's a gate.
What a Gate Actually Is
A gate is a check that sits between "the system decided to do something" and "the something actually happened." It runs automatically, it returns pass or fail, and there is no manual override. Fail the gate and the action doesn't go out. That's the whole contract.
An automation without a gate is just a faster way to make a mistake at scale. The gate is what turns "it can publish" into "it can publish safely"—and those are not the same sentence.
Every System Has One
My content sites make one change a day and then have to earn the right to ship it. The site has to build, links have to resolve, pages can't render empty, and a scan checks the output for a non-compliant price before anything leaves my machine. If any check fails, the change dies where it stands. I never see it, because it never happened.
The commerce backend's gate looks different but does the same job. A reconciliation loop runs every few minutes and enforces one rule: a card may only be listed on a secondary marketplace if it still has an active primary listing. Anything that fails gets delisted. Here the gate isn't a checkpoint before a single action—it's a standing test the whole system has to keep passing, forever.
The onboarding automation gates every step on the one before it. Create the identity, confirm it worked, then assign the device. Each step checks for success before the next begins, so a half-finished run stops cleanly instead of building on a broken foundation.
Know Which Way to Fail
The most important decision in a gate is which direction it fails.
A publish gate fails closed. If the check can't confirm the page is good, it blocks the ship. Better to skip a day than to push something broken to the open web where everyone can see it.
A morning report fails open. My finance system sends one short email every day, and the logic that decides what goes in it is allowed to break—when a rule evaluator falls over, it degrades to a log line and the email still goes out. A missing morning email is its own kind of failure. You never want the alarm that's silent precisely when something is wrong.
Get these backwards and you either ship garbage confidently or go dark quietly. Both are worse than the failure you were trying to avoid.
The Gate Beats the Review
I can't read every diff a daily routine writes. If my trust depended on reviewing the work, I'd be the bottleneck—and the whole point was to not be the bottleneck.
So I stopped reviewing the work and started trusting the gate. One check, run the same way every single time, is something I can actually reason about. A stack of diffs I skim at the end of the week is not. The tighter and dumber the gate, the more autonomy I can safely hand over on the other side of it.
People think the impressive part of an autonomous system is the part that acts. It isn't. Anything can act. The impressive part is the thing standing at the door, refusing to let the bad version through. Build that first, and you can let the rest run wild.