How do you stop an agent approving its own work?
The authorization engine refuses an approval capability to any non-human principal before it looks at what that principal has been granted. It is a branch in the code rather than a setting, so there is no configuration that turns it off, no role that can be composed to include it, and no autonomy level at which it changes. An agent can prepare, propose and explain. A named person disposes.
Why configuration is the wrong place for it
Most systems express this as a role you do not grant. That is fine until somebody clones a role to fix an urgent access problem on a Friday, and it is exactly the kind of change nobody reviews closely because it looks like the eleven that came before it.
A guarantee that depends on nobody making a reasonable-looking mistake is not a guarantee. So the check runs before grants are consulted at all: whatever an agent has been granted, an approval capability is refused.
The related trap: two machines checking each other
The tempting design is an approving agent, separate from the proposing one, with different training or a different prompt. It satisfies maker-checker on paper and it has one accountable party, which is none.
The point of a second signature is not that a second process ran. It is that a person is answerable. An agent cannot be called into a room and asked what it was thinking.
What an agent can do instead
Hold an identity in the same tables as a person, with a charter, a value ceiling, a named human owner, and duty constraints evaluated by the same engine. Appear in the same access review. Have its authority widened only by one person asking and a different person agreeing, which is refused in three places including a database constraint.
And be measured. How often each agent has been agreed with is counted from what humans actually did with its output, not claimed.
What this does not do
This stops an agent approving. It does not stop a person approving badly, which is a different and more common problem. The answer to that one is measurement rather than prevention: median time spent, whether the evidence was opened, whether anything is ever rejected, and whether a queue was cleared in bursts. An approver who has never rejected anything over five hundred items is investigated rather than congratulated.