Why 'check with me first' doesn't hold on its own, and the stage that does

Give approval its own status field

Instead of asking a model to remember to check, give the work a status that lives outside the conversation: drafted, approved, sent. The model is only ever allowed to write into 'drafted.' A separate step, driven by a person, is the only thing that can move an item to 'approved.' A third step, which the model never calls, is the only thing allowed to act on anything sitting in 'approved.'

type Status = "drafted" | "approved" | "sent";

function createDraft(input) {
  const draft = callModel(buildPrompt(input));      // the ONLY model call
  return saveItem({ status: "drafted", draft, createdAt: now() });
}

function approve(itemId) {
  setStatus(itemId, "approved");                     // a person calls this
}

function release(itemId) {
  const item = getItem(itemId);
  if (item.status !== "approved") throw new Error("not approved");
  act(item.draft);
  setStatus(itemId, "sent");
}

The gate can be light

This doesn't mean a person has to read every line of every draft. A queued item that sends automatically after an hour unless someone cancels it is a real gate. A daily digest where ten drafts get approved at once is a real gate too. What makes it count is that moving to 'approved' is a separate step the model cannot shortcut, not that a human reads every word first.

The email-sending version of exactly this problem, and the specific gate that fits it, is its own playbook.

See also: Assistant that says it sent an email and didn't

Make 'waiting for approval' visible somewhere a person opens

A status field nobody looks at is just a column, not a gate. The approval step only works if there's a view or a digest that actually surfaces what's sitting in 'drafted,' so a person has a reason to open it and move something forward rather than it sitting there until someone happens to check.

A firmer instruction doesn't close this

It's tempting to fix a near-miss by adding more emphasis, words like always or never skip this. None of that changes the actual mechanism. The gap sits in where enforcement lives, inside the same system that was supposed to be checked, not in how firmly the instruction was phrased. Moving approval into a separate state outside the conversation is what actually closes it.