An AI agent drives the system over MCP with a scoped token — and is still stopped at the four-eyes gate. Operable is not trusted.
The whole flow, end to end
The agent uses the human surface. An MCP tool forwards to the exact route() the UI calls — same token gate, same scope gate, same Zod schema. There is no privileged back door for automation.
Scoped, hashed, attributable. The PAT stores only a SHA-256 hash (raw shown once), can never hold the bare * scope, and every action is audited with via = token — so the agent is named in the trail.
Operable ≠ trusted. The agent performs the action, but the action is a maker-checker mutation that lands pending. The four-eyes gate blocks the agent from approving its own request — a human signs off. This is the thesis.
Mail = email sent Bell = in-app alert Amber diamond = automatic check Teal diamond = a human decides
The agent gets exactly the human grant — no more. It passes auth, scope, and schema like anyone, performs the action, and writes an audited pending request. But the four-eyes gate treats the agent as a principal: it cannot approve its own work. A human still signs off.
Why agent-operable is safe
The agent holds a scoped PAT, not the keys — every route is scope-gated (AND), and a missing scope is a clean 403, never a silent allow.
The same four-eyes rule that stops a human self-approval stops the agent — decided_by <> requested_by, enforced in code and at the database.
Every agent action and every human decision is an immutable, fail-closed audit row — the agent is a named principal, not an anonymous script.