Deterministic MCP Workflows: Approval Gates in AgentForge
By Hamza Shaikh (@HamzaShaikhAI) · · 3 min read
Why Autonomous Tool Execution Needs Explicit Policy Tiers
AgentForge is an open-source ($0, MIT-licensed) TypeScript integration harness for Google Antigravity built in 2026 to stop autonomous agents from executing unguarded external writes or leaking credentials. Instead of granting broad unrestricted shell permissions, AgentForge evaluates every MCP bridge manifest against schema v1.0 in bridge-validator.ts before registering capabilities.
In practice, separating actions into read, local-write, external-write, publish, and destructive tiers keeps local productivity fast while enforcing mandatory human approval checkpoints whenever commits are pushed, packages are published, or social posts are drafted for external platforms.
Four-Tier Permission Matrix & Credential Isolation
AgentForge splits execution safety into four auditable layers inside permissions.ts and workflow-engine.ts. First, read actions (listing repositories, inspecting health, reading workspace files) run immediately. Second, local-write edits stay scoped to workspace files. Third, external-write, publish, and destructive actions pause deterministically for explicit user sign-off.
Finally, secret tokens remain strictly isolated outside bridge manifests and prompts using environment variable references, while audit records log approval decisions and verification responses rather than raw credentials.