Flag vs block: when to let an agent ask instead of stop
Hard blocks stop bad spend but also stop legitimate work. Approval thresholds keep agents fast. Here's the decision rule for when to use which.
Every spend firewall decision is APPROVED, BLOCKED, or FLAGGED. The first two are easy to understand. The third is where the design actually lives — and where most teams get it wrong.
Block for certainty
When a transaction can never be legitimate — banned merchant, over a hard cap, category blocked — BLOCK is right. No review needed, no queue, final. Unknown vendors are the classic case.
Flag for ambiguity
When a transaction is suspicious but might be legitimate — over a threshold, a new merchant, off-hours — FLAG and route to a human. The agent pauses, the human decides in minutes, and legitimate work proceeds. This is what the approval queue is for.
The decision rule
If you'd never approve it, block. If you might, flag. If it's routine, approve. Tune with the audit log: all-approved flags mean the threshold is too low; all-denied means the agents are trying the wrong things. Start with three rules →