Human in the loop is usually implemented as a switch: approvals on, or approvals off. Both settings are wrong for an agent that runs shell commands, and you find that out the same way everyone does, which is by watching a long task die on its third ls.
The stall looks like this. Your agent is working through something multi-step, it needs to look at a directory, the harness raises an approval, and the run stops dead waiting for a human who has gone to make coffee. Multiply that by forty tool calls and the agent is no longer autonomous, it is a very expensive interactive shell.
So people reach for one of two fixes, and both make it worse.
The two fixes that are not fixes
Turning the gate off. Now rm -rf runs unattended too. The gate was not the problem, and you have removed the only thing standing between a plausible-looking command and an irreversible action.
