A water-utility operations agent can recommend a valve shutoff based on sensor readings, but the design must ensure it cannot execute that action on its own without an operator confirming it first. What should the architecture include?

A human-in-the-loop confirmation gate placed directly in front of the valve-shutoff tool means the agent's recommendation and the tool's execution are two separate steps, with an operator's explicit approval required between them, which is exactly what "cannot execute on its own" demands. A Model Armor filter checking the recommendation text for factual accuracy addresses whether the suggestion is well-reasoned, which is a quality concern, but it says nothing about whether the action itself requires human sign-off before it runs; a factually sound recommendation could still execute autonomously without a gate. An Agent Gateway rate limit capping how many recommendations the agent generates per hour controls volume, not authorization; even a rate-limited agent could still autonomously execute a shutoff if nothing blocks the action itself. A PAB policy restricting the agent to one project is an access-boundary control about where the agent can reach, not an action-level control about whether a specific high-impact tool requires confirmation before it runs, so it wouldn't stop an in-scope shutoff action from firing unattended. A scope caveat: a confirmation gate is only effective if the shutoff tool has no alternate path that bypasses it, so the architecture must ensure the gated path is the only way to trigger that action. As an operational check, an architect can trigger a test recommendation and confirm the shutoff tool call is held pending explicit operator approval rather than firing immediately.