EXPERIMENT_031 // REVERSIBILITY-TIERED.APPROVAL.GATE
Watch a scripted mock agent work through nine tool calls — reading files, editing config, deleting data, publishing externally — with each one classified by reversibility tier and gated as auto-run or approval-required, and personally approve or deny the ones the gate blocks on.
LOADING EXPERIMENT...
A mock agent proposes nine tool calls in sequence — two reads, three reversible edits, two destructive deletes, two external publishes. Each one is classified live against a small trust formula (track record times reversibility times blast radius) and either auto-runs or blocks for your explicit approval. Deny a gated action and watch the consequence ripple forward: any later step that depends on the one you denied is visibly skipped rather than quietly disappearing.
HOW IT WORKS
Nine tool-call steps live in one fixture file, each carrying an action label, a reversibility tier, and a mock track-record score. No LLM call and no real tool execution back this demo — the same run produces the same classifications and the same gate decisions every time, so the mechanic is fully inspectable rather than dependent on a model's mood that day.
One small, pure function multiplies three 0-1 factors: how often this action type has succeeded before, how undoable it is, and how contained its effect is. Multiplication is deliberate — a flawless track record on an irreversible, publicly visible action still falls through to approval, because a single near-zero factor should drag the whole score down rather than being diluted by the other two.
Read, reversible edit, destructive, and external publish each get a distinct icon, a text label, and a colour — three independent signals, so the tiers stay distinguishable for colour-blind visitors and read correctly with a screen reader, which only ever hears the label and the icon's accessible name is intentionally omitted as redundant.
When a step's trust score falls under the gate threshold, the scenario stops and waits — nothing advances until you click Approve or Deny. Denying a step that a later step depends on doesn't just skip a line of copy: that later step never reaches its own classification gate at all, and renders as skipped with the reason shown, not silently dropped.
WHAT THIS PROVES
A governance gate doesn't need a live model in the loop to be legible: reducing "trust = track record x reversibility x blast radius" to a documented, quotable pure function makes the same authorization logic that runs across Diana's own agent fleet playable by a visitor in under a minute, with the reasoning visible at every step rather than hidden behind a black-box score.
Denial has to be a real branch, not a dead end, for an approval gate to mean anything. Wiring one step's outcome to gate a later step's eligibility to run at all is a small mechanism, but it's the difference between a demo that performs safety theatre and one that actually shows a blocked action changing what happens next.