An enterprise's deployment gates have accumulated until releases take weeks. Which gates should remain automated, which manual, and which removed?

Automated, blocking

Anything a machine can evaluate deterministically:

• Tests, including contract verification.
• Static analysis, dependency and licence scanning.
• Policy checks — encryption, network exposure, region, tagging, destructive migrations.
• Artefact provenance verification.
• Health checks and progressive-delivery gates comparing canary against control.

These are fast, consistent and never tired. Every one of them replaces a human check that was slower and less reliable.

Manual, and worth keeping

A small set where human judgement is genuinely required:

• A business decision about timing — a release during a peak period, or a change with customer-visible behaviour requiring coordination.
• A risk acceptance for something the automation flagged and someone with authority is accepting.
• A go/no-go for a high-blast-radius change, such as an irreversible migration.

Each should have a named decider and a bounded response time, or it becomes a queue.

Removed

• Approvals by people with no basis for judgement. A manager approving a change they cannot evaluate adds delay and no risk reduction, while creating an appearance of control that is worse than none because it is trusted.
• Duplicate checks already performed automatically earlier.
• Gates added after an incident that a targeted automated check now covers.
• Sign-offs whose purpose nobody can state.

The reframing for the compliance conversation

The requirement is usually evidence of control, not a human approval. A pipeline that enforces separation of duties, records who changed what, verifies provenance and blocks non-compliant changes produces better evidence than a signature — it is continuous, complete and tamper-evident, whereas an approval demonstrates that someone clicked.

Making that argument, with the evidence the pipeline produces, is frequently what allows manual gates to be removed without weakening the control.

The measure

Lead time from merge to production, and the proportion of it spent waiting for a human. If most of the time is waiting, the gates are the bottleneck and their risk reduction should be justified against that cost.