Approval-Gated Agent Platform

The problem

I wanted to automate a real, repetitive workload, my own job search, without handing decisions or credentials to a language model. The interesting problem was the controls: what each component can reach, who approves actions, and how everything is recorded.

Architecture and implementation

• Eight deterministic services on their own schedules (search, auto-apply, email outbox, monitor, attempt history, backup, action service, dashboard) coordinating only through SQLite and files with locks.
• Language models are limited to bounded writing steps: cover letters and essay drafts that I review. None decides what happens next.
• Applications are submitted only after I approve them. Changes to settings go propose, then confirm with a second factor, then audit.
• The assistant has no network access. It asks a tools service for data, which redacts before answering; only a separate gateway holds a workspace-scoped API key and enforces a monthly budget.
• An append-only audit log hash-chains every entry and records refused requests: cross-site forms, spoofed identity headers, wrong methods.

Decisions and challenges

Least privilege by process

Each service runs under its own permissions; the action service and dashboard cannot read credentials, and the assistant cannot reach the internet.

Human in the loop

Nothing is submitted until I approve it, and email verification codes are relayed by me rather than read by the bot.

Fixing what the model got wrong

The assistant mislabelled UTC timestamps, so tool outputs now carry explicit Central-time labels.

Working around bot defences honestly

Where job pages block automation, scoring falls back to search-result data. No CAPTCHA solving or fingerprint spoofing.

Verified outcomes

• Deployed on 24 October 2026 and running unattended on a private server, with every action going through approval and the audit log.
• Assistant testing cost $0.44 across 65 calls, inside the monthly cap.