Human gate

A human gate is a control point where a message crossing a trust boundary is held for a person to review before its text ever reaches the receiving agent's context. The essential design decision is what the gate withholds: not permission, but the body itself. A held message exposes only structural metadata — the kernel-verified sender uid, the message length, a thread id, a timestamp — and never its text, until a human releases it. Withholding the body is the protection; a warning label on top of delivered text is not, because a language model that has already read hostile text has already been exposed to it. This is why "mark it as suspicious and deliver it anyway" fails as a defense: the mark does not undo the reading. In agentixmesh, the human gate is the default for any traffic that crosses a trust boundary (such as between OS users), and that default is deliberately not downgradable to automatic delivery — convenience is exactly the pressure that erodes trust boundaries. Within a single user's own sessions, where the sender is by definition yourself, messages flow without the gate; the boundary of the gate matches the boundary of trust.

The gate protects against prompt injection at the boundary; the full model is described under trust model & honest limits.