Change Advisory versus Automated Gates

Definition

Two models for controlling production change: a change advisory board reviewing and approving changes, or automated gates in the pipeline that verify and permit them.

Why review boards underperform

• The reviewer cannot meaningfully assess the change. A board reviewing dozens of changes across unfamiliar systems is approving a description, not a change.
• They add latency, which forces batching, which increases batch size — and larger batches are riskier, so the control makes the outcome worse through the mechanism it was meant to improve.
• They create pressure to route around them, producing unapproved changes that have no control at all.
• The evidence does not support them. Software delivery research consistently finds that external approval processes have little or no positive effect on stability, while frequent small changes with automated verification perform better on both throughput and stability.

What automated gates provide

• Every change verified identically, without fatigue or availability constraints.
• Faster feedback, so batch size stays small.
• A complete evidence record — what was tested, what passed, who approved the code, when it deployed — which is better audit evidence than a meeting minute.
• Consistency, since the gate cannot be persuaded.

Concretely: automated tests, security and dependency scanning, policy checks on infrastructure, peer review of the code, canary analysis with automated rollback.

Where human review still belongs

• Genuinely novel or high-risk changes — a data migration, a change to a security boundary, a cutover.
• Changes crossing organisational boundaries where coordination is genuinely required.
• Where regulation explicitly requires a named human approval that cannot be automated.

The distinction is risk-based: automate the routine, review the exceptional. A model that reviews everything reviews nothing well.

The regulated context

Regulators increasingly accept automated controls where the automation is demonstrable — the pipeline enforces the control, and the record proves it operated. That is frequently stronger evidence than a board's minutes, and making that argument is worth the effort, because the delivery benefit is large.

Interview question

"How would you replace a change advisory board without weakening control?"