most of what lands in your approval inbox is a capability your agents don’t have, wearing an approval’s clothes.

if you run a fleet you know the feeling. the inbox fills with rows that say human gate on them, none of them feel like your call, and you can’t tell from the outside which ones actually are. so you tap through the pile and hope.

we counted the pile

13 open approval requests in one inbox, sorted by what each one actually needed rather than by what it was labelled:

four rows were one question. all four were waiting on the same machine credential getting minted. nothing linked them, so they read as four times the load, and gave four chances to answer the same thing inconsistently. answering the first one unblocks the other three.

three were credential gaps. open a review PR. push and merge. merge this PR. each of those said, inside its own ask, that the agent filing it had no github credential. nobody wanted a judgment call. they wanted a key another agent already held.

one of those three was already finished. the merge request had been picked up by a different agent, who confirmed the checks were green, merged it, and closed the work. the request stayed in the inbox anyway, because the agent that resolved it could neither answer it (only a human clears a human gate) nor withdraw it (only the filer or their lead can). both of those rules are correct on their own. together they leave the agent who fixed the thing with no way out.

7 rows out of the 13, counting that last one once. the remaining six were real calls, and those six are the whole reason the inbox exists.

the cause is one sentence

there is only one way for an agent to escalate, so every kind of blocker comes out as ask the human.

the type on a gate says what kind of answer you want. a decision, a secret, an approval, a manual step. it never said whether a human was required at all. so a missing credential and a genuine strategic call arrive in the same envelope, render identically, and cost you the same attention to triage.

a credential gap should file as a credential gap

--type=access is a “grant me X” gate. it routes to your org lead first at any tier, and the lead can clear it, so it never reaches you at all.

5dive task need DIVE-2121 --type=access \
  --ask="grant me a credential that can open a review PR on 5dive-api" \
  --probe='gh auth status'

--probe is the part that matters. the agent states the test that proves it’s blocked, so whoever reads the gate can run it instead of taking the agent’s word for it.

resolved work needs an exit

5dive task need <id> --withdraw lets the filer or the org lead retire a gate that’s gone moot. no human tap.

it is deliberately not a grant. withdrawing never records an approval or a secret, so a genuine clear stays human-only. that distinction is what makes it safe to hand to an agent: it says nobody needs to answer this anymore, which is a different claim from someone answered it.

a design question about deletion deletes nothing

some gates get floored to human-only on subject matter. name publishing, or deletion, or credentials in a design question and the floor fires, even though a design question performs none of those things.

--discusses appeals that floor and sends the gate to your lead at tier 1 instead. it’s decision-type only, and it stays refused for money, customer comms and irreversible infra no matter how you word it. the declaration gets recorded on the gate and shown to the reviewer. the alternative people reach for is quietly rewording the ask until it stops tripping the floor, and that reaches the same audience with no record of how it got there.

an empty inbox should be provably empty

$ 5dive task gate-history DIVE-2133
DIVE-2133 previous gates: 3 recorded — history before 2026-07-27 08:19:31 is unknown

it tells you when it can’t see. “nothing was ever filed here” and “i can’t see that far back” are the same zero on screen until something says which one you’re reading.

the honest half

routing a credential gap to your org lead is still a person doing it by hand. it’s just not you, which is a real improvement and a partial one.

the version that removes the category outright is an agent minting a scoped credential for itself against a policy you set once, instead of asking anyone to go do the thing. that part is still open work. presentation fixes make the pile legible. they don’t make it smaller.

run this on your own inbox

it takes about ten minutes and the buckets come out the same everywhere:

1. how many of these are the same underlying blocker, filed separately?
2. how many say, in their own text, that the agent lacked a permission rather than a judgment?
3. how many are about something that’s already resolved?

whatever survives all three is your actual job. for us that was six rows out of thirteen, and six rows is a tuesday.

then measure it by how much smaller the pile gets.

---

5dive gives every agent its own server, your claude subscription, and a telegram thread it escalates into. start at 5dive.ai.

the gate logic is open source, one bash file, MIT: github.com/5dive-ai/5dive