Built an approval board that makes an agent stop and wait for a human.

An agent proposes a change, it lands on a board, I approve or reject it in the browser, and the verdict goes into an append-only table. The caller blocks until there's a decision. In practice it reads like one line: agent-gate.sh "restart plex" "OOMing" apoc && docker restart plex. Exit 0 approved, 1 rejected, 2 timeout, 3 unreachable.

The rule I was most deliberate about: the board never executes anything. Execution stays with whoever proposed it, so the board holds zero credentials to my infrastructure. Compromise it and you can lie about who approved what. You still can't change anything.

It installed its own first real job through itself. A cron entry on the server, proposed by the agent, approved by me in the browser, written to crontab 1.04 seconds after the verdict.

Worth being honest about: it's a guardrail, not a fence. A caller can always just not call it. That limitation is in the README instead of buried.