Inbin Gate: safe auto-approve for IBM Bob

Problem: Developers switch on auto-approve in IBM Bob because approving every action by hand throws away what Agent mode promises. But an agent on auto improvises: the documented failures (Replit's deleted database, Gemini CLI's wiped files, Claude Code's git reset --hard, hallucinated packages) needed no attacker, only an ordinary chore. And it reads untrusted text all day. Teams choose between speed and safety. Solution: Inbin Gate makes auto-approve safe by changing the question. Instead of "does this look malicious?" it asks "did someone with authority state this value?". It installs as a Bob PreToolUse hook: before Bob runs a terminal command or writes a protected file, the gate classifies what it would do to this repository (regenerable output or unrecoverable work, local history or a force-push, a reinstall or a new dependency) and decides; exit code 2 blocks it. Bob keeps every tool, auto-approve on. Each tool executes only when its operands were stated by the developer in their own words (typed out of band, in a terminal the agent does not control) or established by the repository's maintainers (package.json scripts and dependencies, a small policy file, CODEOWNERS). Text Bob read is information, never authority. A refusal names the reason and the source file, and Bob asks the developer instead. A published resolver (PSAP) derives authority from the channel a value arrived on, never from the value: the developer's signed intent, the repo's shared config, and what a maintainer writes in an issue hold a grant; the agent's proposal never does. Who uses it and how: Any developer running Bob in Agent mode: type the intent once, let Bob work with auto-approve on. Evidence: Refusing unstated values is by construction, so we do not count it as a finding. What we measured: Bob on auto with no gate, given six ordinary chores on a repo with things to lose, lost nothing but ran an unrequested sudo chown, installed a package it picked itself, and force-pushed a shared branch; on a planted CI-log "fix" it force-pushed a release branch. With the gate, nothing destructive ran and no genuine work was refused: four chores needed no human, two paused once (a new dependency, a force-push), at six percent more tokens. On a real repository (lukeed/clsx) Bob on auto deleted the developer's notes twice and their uncommitted edit once; gated, nothing was lost in six chores, at four percent fewer tokens. In an earlier run Bob, refused twice, tried to write the developer's intent file to authorise itself; it failed: the intent is signed with a secret the agent cannot read. The same gate on a public prompt-injection benchmark (AgentDojo, banking) refused every injected operand in 144 runs where the benchmark's own defenses let 12.5% to 50% through. Why it is new: Existing defenses detect attacks in text or restrict which tools an agent may call. Inbin Gate restricts which values may drive a consequential action, by who said them. That is what lets auto-approve stay on.