Engineering
One governed approval, not a gauntlet of checkpoints
Every AI-delivery vendor promises “human in the loop.” In practice that means a row of checkpoints. Here is why control belongs at one governed gate, not scattered across the pipeline.
A pipeline with five sign-offs does not give you five times the control. It gives you five places to rubber-stamp, five owners to chase, and a comfortable illusion that review happened. Control that lives everywhere lives nowhere. So the system is designed around a single, governed approval — and everything else is made honest instead of obstructive.
Checkpoints dilute control
The instinct is understandable: AI writes a lot of code quickly, so surely you inspect it at every stage. But a gate passed dozens of times a week stops being a gate. It becomes a reflex — approve, approve, approve — and the more of them you add, the less any one of them means. Worse, a machine that halts a merge on a heuristic (a coverage number, a drift score) is not giving you control; it is giving you a flaky build and a reason to distrust the tool.
One approval, on the record
In lumaq there is exactly one required approval. It is not a status flag someone flips; it is a record — append-only, and it can’t be edited away. Done is final. A change after approval is a new revision work order, never a quiet reopen. That single decision carries weight precisely because it is the only one, and because it leaves a mark auditors and boards can read later.
Separation of duties, in the domain
The approver can’t be the author — user or agent — of the work. That rule sits in the domain model, not the interface, so it holds whether the work arrived through the web app, the API, or an agent over MCP. An agent can take a work order as far as review and no further, on every channel. There is no back door, because the boundary is not drawn in a screen; it is drawn in the system.
Why nothing else blocks
Verification still runs constantly. On every push, code is checked against the blueprint and the blueprint against the requirement, and the gaps come back as findings. But findings inform the approval — they never block the merge. The machine’s job is to make the truth visible; the approval decides. Keep those two jobs separate and you get both speed and accountability. Blur them and you get neither.