A pipeline has accumulated a dozen approval gates and lead time has doubled. Which gates are worth keeping?

Which gates are worth keeping

Automated gates that fail fast and produce evidence: tests, security scanning of what is actually reachable, dependency direction checks, policy checks, provenance verification, performance budgets on named paths.

These are cheap, consistent, run in seconds, and produce a logged, timestamped, attributable record — which is precisely what an auditor asks for and what teams otherwise spend weeks assembling.

Which are not

• Human approval on a routine change. It has fixed capacity against unbounded demand, becomes the throughput ceiling, and the approver typically has less context than the author. An approval that is always granted is a delay with the appearance of a control.
• Gates that duplicate an automated check, added because someone did not trust the automation. Fix the automation instead.
• Gates with no defined criteria, where the approver is deciding on intuition. A control whose pass condition is unstated cannot be assessed and cannot be improved.
• Manual testing of what is automatically tested.

The reframing that resolves the tension

Human review should be reserved for the significant minority, with a defined trigger for what counts as significant — so the reservation is a rule rather than a judgement made under time pressure.

The trigger is usually: a change to a security boundary, a data migration, a change to a regulated calculation, or a first deployment of a new component. Everything else goes through automated gates and progressive delivery, where the safety comes from small changes, fast rollback and automated halt conditions rather than from approval.

The evidence for the reframing

Teams with high deployment frequency and small change size have lower change failure rates, because changes are individually attributable and individually reversible. Gates that reduce deployment frequency therefore reduce safety, which is the opposite of their intent and is the most robustly counter-intuitive finding in delivery practice.

What to measure

Lead time with its components broken out — including approval wait, which is frequently the largest and is invisible inside the total. That single measurement usually settles the argument about which gates to remove.