MyClaw
Agentic automation with approval gates on side effects
A private Discord-first assistant across four Cloud Run services. Retrieval runs over documents ingested asynchronously through Pub/Sub, and anything with an irreversible side effect (sending mail, creating calendar events) produces an approval request rather than executing. The design principle was to fix the manual workflow first and only then automate it.
Verified: each of these is checkable in the repository
- 4
- Cloud Run services in one monorepogateway, assistant-api, ingestion-worker, admin-web
- 0
- irreversible actions taken without approvalcalendar and email create an approval request
An assistant that can send email on your behalf is one bad inference away from an embarrassing, unrecallable action. The usual response is a better prompt. The better response is to make the irreversible path require a human.
A Discord gateway verifies request signatures and handles slash commands, forwarding to an assistant API that holds state in Postgres, runs retrieval, and calls Vertex AI. Document uploads land in storage and trigger a Pub/Sub message that an ingestion worker consumes to chunk and embed asynchronously. Any action with an external side effect creates an approval record that must be confirmed by an explicit command before it executes.
Why it is built this way
01Approval gates on side effects, structurally
Irreversible actions cannot execute inline. They create a record and wait. The gate is in the architecture rather than in a prompt instruction the model might ignore.
02Ingestion off the request path
Uploads return immediately and processing happens through Pub/Sub, so a large document does not block a chat turn and a failed parse can retry without the user present.
03Fix the process, then automate it
I mapped and corrected the manual workflow before building the agentic layer. Automating a broken process just produces failures faster.
Approval gates turned out to change the product, not just its safety. Once irreversible actions surfaced as explicit requests, I could see how often the agent wanted to do the wrong thing, which was a far more useful signal than a benchmark, and it came for free from the safety mechanism.
Next project
AIDE
LLM schema profiling behind a typed service contract