Approval & Review
Orbit’s safety model is a single human gate: nothing runs until you approve it. Around that gate sit a pre-check before approval and a validation pass after completion, so you have signal at both ends without slowing down.
The approval gate
Section titled “The approval gate”Every queued prompt waits as a card until you approve it. This gate is the real human-in-the-loop. For routine, low-complexity work it can be the only gate you need — the dashboard approval is enough, so those prompts can be queued directly. For anything heavier, the gate is where you read the prompt and decide.
Review per tier
Section titled “Review per tier”Each complexity tier can be configured to handle review differently. A tier can auto-review the prompt with a fast model (Gemini Flash-Lite), show a manual reminder so you read it yourself, or skip review entirely. High-complexity prompts can additionally surface a review card before the Approve button, and you can turn on a deeper review pass with a stronger model when the stakes justify it.
Pre-check warning chips
Section titled “Pre-check warning chips”Before you approve, a synchronous heuristic pre-check tags each card with amber chips for risk signals — a very large prompt, install commands, multi-part scope, a wide file footprint, or a prompt that will pause mid-run for input. The chips inform you; they never block approval. You stay in control of the call.
Validation after the fact
Section titled “Validation after the fact”When a prompt completes, a lightweight pass inspects the resulting commit diff and labels the outcome: Validated (Auto) when the change looks clean, Ghost Ship when the completion claims success but no real file changed, Wrong Files when the diff touched files unrelated to the prompt, or Auto Skipped. This is your early-warning system for an agent that reported done without actually delivering.