Approval gates on consequential change

The problem

The marketplace had grown a layer of internal automation the way most successful platforms do: one useful script at a time. Individually each was sensible. Together they could adjust listing prices, change seller payout rules, and suspend accounts — with no consistent record of what had been changed, by which job, on whose authority. A misconfigured rule had already produced a payout run the finance team had to unwind by hand.

The instinct was to add an approval step to everything. That would have made the platform unusable within a week.

What we did

We inventoried every automated path that could mutate money, price, or account status, and classified each by whether its effect was reversible and how far it propagated before anyone would notice. That classification, not a blanket policy, decided where gates belonged.

Reversible, bounded actions kept running unattended, with better logging. Actions that moved money, changed a published price, or restricted an account were rebuilt to require an explicit human approval — presented with the full computed effect, including the number of accounts touched and the total value at stake, before anyone could approve it. Anything that exceeded a pre-agreed blast radius stopped and waited regardless of who was asking.

We also made the gates honest under pressure. There is an emergency path, it requires a named approver and a reason, and it announces itself loudly afterwards. Break-glass mechanisms that are inconvenient get bypassed; ones that are merely accountable get used correctly.

What we shipped

• A classified inventory of every mutating automated path, by reversibility and blast radius.
• Approval gates on money movement, published pricing, and account restriction, showing computed effect before sign-off.
• Hard blast-radius limits that halt a run rather than proceed at scale.
• A single audit record covering automated and human actions, readable by finance without engineering help.
• An accountable emergency path, logged and reviewed after use.

The result

No unattended change has moved money since the gates went in. The finance team stopped discovering automation through its consequences, and the engineering team kept the speed that mattered, because most automation was never the dangerous kind and was left alone.

The quarterly review after launch found the gates were being used as designed rather than routed around — the practical test of whether governance was drawn in the right place.

Client identity withheld by agreement.

Contact