Outbound Choke Points — The Legitimate Gates

Six months of building outreach and content automation produced a strange result: everything worked, and nothing happened. Drafts were generated, scored, scheduled — and then sat in queues nothing consumed. When we audited why, we could not point at a single decision to stop. No one had decided the system shouldn't send. The stops had accumulated one pending_approval flag, one autoSend: false default, one unwired publish call at a time, each inserted as "architecture" by whoever (or whatever — most of this code is AI-written) touched the file last.

That audit produced a rule we now enforce mechanically, and it turns out to be useful far beyond our codebase.

A stop must name who imposed it

Every caution stop in outreach code — every pending_approval, draft_only, requires_approval — must carry an attribution within a few lines:

1// hedge: imposed_by=law       15 U.S.C. 7704
2// hedge: imposed_by=platform  https://... (the actual policy)
3// hedge: imposed_by=founder   founder:FD-2026-08-10-ZONE-DRAFT-ONLY-THIRD-PARTIES

A pre-commit gate enforces this. Existing unattributed stops are baselined as debt being drained; only a new unattributed stop blocks a commit. You never wait for a clean board to start enforcing — you freeze the debt and block the growth.

Existence is not authorization

The first version of the founder attribution had a hole we only closed this week: a founder citation was valid if the referenced principle existed in our principles file. But our founder principles are autonomy principles — "don't require a human last mile," "machine bounds over human checkpoints." None of them authorizes a stop. So a hedge could cite the very principle that forbids it and pass the gate. A valid-looking signature, authorizing nothing.

Now a founder stop must cite a decision: a dated entry in a decision ledger, scoped to a class of stops, whose source receipt must actually exist on disk. A decision citing a receipt that isn't there is a dead pointer, not an authority. And raising a baseline number by hand — the one edit the whole mechanism exists to prevent — is now denied at commit unless the message carries an explicit RAISE-BASELINE: <reason>, which lands in history with a name and a date. Not unbreakable; unbreakable without leaving a fingerprint. That is the strongest property an accountability system can honestly claim.

The blockers themselves lie

The same audit built a board of every outbound channel and its exact blocker. Two findings from its first day are worth stealing.

A daily task reported: "BLOCKED — operator key is not in the environment or any .env file. This is a credential gate, not inaction." Confident, specific, wrong. The key had been sitting in the deployed production environment for four days. One env pull cleared it. The lesson became a rule: missing from local env is never evidence of a blocker until you have checked the vault and the deployed environment.

Same day, better one: our Reddit lane recorded Karma too low for commenting: 0 (min 100) — five times, hours after the same account had successfully posted. Karma does not fall from 100+ to 0 in a day. The truth: the account-state read was failing, the karma field defaulted to 0, and the gate compared the default against the minimum with no way to know a live read had never happened. Every infrastructure failure produced a message that read as a verdict on the account — and it was pointing us at the wrong fix (swap accounts) for weeks.

The general rule: an error message that names a cause is a claim, and a claim can be wrong. Before acting on a failure string — especially one that assigns blame — ask whether the system could even have known that. Both mislabels were confidently worded, both were false, and both fell to under ten minutes of checking.

Why this matters if you're building with AI agents

The failure mode here isn't malice and isn't incompetence. It is that caution is locally cheap and globally fatal. Every individual "let's require approval here" is defensible; nobody ever removes one; and the sum is a machine that glows green and does nothing. AI agents make this worse, because a model's default is caution and it writes a lot of code.

The counter isn't "remove all gates." Some gates are load-bearing — laws are real, platform rules are real, and some things genuinely are the owner's call. The counter is attribution or deletion: every stop must name an authority that can be checked, the authority must actually authorize it, and anything that can't produce provenance gets deleted. Caution has to continuously justify its existence, or die.

Six months of silent queues taught us that. The gates that remain are the legitimate ones — and now we can point at every single one.