agent auto-advanced candidates past a stage requiring hiring-manager approval - the workflow rule changed but the...

TL;DR

Re-fetch the live stage and approval rules from the ATS before every automation run, and add a hard check that blocks advancing into any stage that requires approval. The agent kept working off a cached config from before the rule change, so it skipped a gate that now exists. Move the wrongly advanced candidates back and log the correction.

The error

Candidate auto-advanced to "Offer" - the stage now requires hiring-manager approval, but the agent's cached workflow config has no approval gate for that stage

Steps

1. Stop the auto-advance automation so no more candidates skip the gate.

Expected: no new candidates land in approval-required stages without an approval record.

1. Pull the current interview plan and workflow rules for the job from the ATS and diff them against the agent's cached config.

Expected: the diff shows the approval requirement the cache is missing.

1. Add a pre-advance check to the agent: read the live rule for the target stage on every run and refuse to advance when approval is required and missing.

Expected: a dry run blocks the advance and logs the reason.

1. Move each wrongly advanced candidate back to the correct stage and notify the hiring manager with the list.

Expected: every affected candidate is back in the right stage and approvals are re-requested.

1. Set the cache to expire fast (minutes, not days) or subscribe to workflow-change webhooks.

Expected: the next rule change reaches the agent before it acts on stale rules.

Use this when

• An agent or automation advances candidates between ATS stages
• A stage requires human approval (hiring manager, offer approval, background check)
• Workflow rules changed recently and automation behavior looks off

Not for this skill when

• The advance was manual and intentional (no automation involved)
• The ATS itself shows the wrong stage (check the UI audit trail first)
• You want to remove the approval gate entirely (that is an ATS admin change, not an agent fix)

Variant phrasings

• recruiting agent skipped the hiring manager approval stage
• agent's cached ATS config doesn't match the live workflow rules
• candidates advanced past an approval gate by automation
• stale stage config caused the agent to bypass approvals

Why it happens

The agent cached the workflow config for performance and never invalidated it. The ATS admin added an approval requirement to a stage after the cache was populated, so the agent's decision logic ran against rules that no longer existed. Cached authorization logic is the riskiest thing to cache because the failure mode is silent permission bypass.

Edge cases

• Partial rollouts: the rule may apply to some jobs and not others, so refresh per job.
• Approvals recorded outside the ATS (email, chat) are invisible to the agent: require the approval to exist in the ATS record.
• Rollback audit: log which candidates were moved back and when, for compliance.
• Webhook delays happen: keep a short cache TTL as the backup even if you subscribe to config-change webhooks.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6DXb049A9mkPWXyY9kc0EQ