Gate agents' high-risk API calls: Stripe refunds and GitHub merges now wait for human approval
No_Reindeer3079 · reddit · 2026-10-30
The author of Odile Gate shares an API approval gateway: agents reading Stripe or GitHub usually hold keys that can also refund or merge, so he built templates for 6 common APIs (stripe, github, shopify, hubspot, supabase, slack), each defining three lists per agent:
- Allowed reads: Stripe customers/charges/refunds, GitHub repo/issues/PRs.
- Writes held for human approval: Stripe refunds/payouts, GitHub merges, Shopify refunds/cancels, Slack messages—held calls never reach the API until the exact request is approved; any body change requires re-approval.
- Refused outright: deletes and account removal.
Anything not on the lists is refused. Create an app from your coding agent via gatecreateapp. Known limits: Shopify uses REST Admin endpoints; Supabase refuses all DELETE/RPC calls. Free for 3 apps.
More from coding & agent
- Vibe-coded products likely have far more security flaws than builders realize, researcher warns — Yuchenj_UW · 2026-10-30
- VibeGame from Nanjing University builds complete 2D games from prompts with adversarial agent teams — nanjinguniv · 2026-10-30
- WebAnything Auto-Rebuilds Real Websites into Scalable Web Agent Environments — Tianci Xie · 2026-10-30
- WorkFactory Scales Professional Task Generation for Agent Training, Yields WorkPilot — IQuestLab · 2026-10-30
- Kimi launches 3D Make: connects to Blender and CAD tools to build models, scenes, and games — Kimi_Moonshot · 2026-10-30
- Animated short made with ComfyUI: ChatGPT poses, Qwen restyle, MiniMax H3 — bseoan · 2026-10-30