When should a platform prevent an action automatically, and when should it require a human decision?

The principle

Guardrails for what a machine can decide; gates for what genuinely requires human judgement — and the gate set must be small enough that it does not become a queue.

Prevention scales with automation; review scales with headcount. As change volume grows, only the first keeps up, so the gate set must shrink to what genuinely needs judgement or the whole system fails.

Guardrails — automatic, no human

Applied to the small set of actions whose consequences are severe and irreversible, evaluated deterministically:

• Public data exposure, unencrypted storage at rest.
• Deployment to an unapproved region, or a resource type not sanctioned.
• Destructive schema migrations without a deprecation path.
• Missing cost attribution or ownership.
• Artefacts failing provenance verification.
• Breaking interface changes against registered consumers.

These need no human because the answer is the same every time, and a human evaluating them is slower and less consistent.

Gates — human decision required

A deliberately small set where judgement is genuinely needed:

• A business decision about timing — deploying during a peak event.
• A risk acceptance for something the guardrails flagged and someone with authority is accepting.
• A go/no-go for a high-blast-radius or irreversible change.

Each needs a named decider and a bounded response time, or it becomes a queue and gets routed around.

The peak-event addition

For a platform facing extreme scheduled demand events, the gate set expands temporarily: a change freeze with an expedited path, and a reliability floor that cost and velocity decisions cannot cross — headroom, redundancy and rehearsed degradation stated as policy so they are not quietly optimised away.

What to remove

Approvals by people with no basis for judgement, which add delay and no risk reduction while creating an appearance of control that is worse than none because it is trusted. And duplicate checks already performed automatically earlier.

The measure

The proportion of the estate actually governed, not the number of gates. A lighter process covering everything beats a rigorous one covering a third.