Approval — Who Accepts This?
1. Who accepts this, and against what standard?
Approval is the first discipline that touches output — and the first where being wrong ships.
Scope and Context act before the work. Approval is the first discipline that touches output — and the first where the cost of getting it wrong is measured in things that shipped.
Approval — the architecture specifying which AI-produced outputs may be applied automatically, which require one reviewer, and which require two.
| Tier | Applies when | Cost of being wrong |
|---|---|---|
| Auto-apply | Reversible, low-consequence, verifiable after the fact | Recoverable |
| Single reviewer | Consequential but recoverable | Real, bounded |
| Dual review | Irreversible, externally visible, or regulated | Unbounded |
Tier by consequence, not by convenience. The instinct is to tier by how tedious the review is — which produces an architecture optimized for reviewer comfort. That is exactly backwards: the tedious reviews are often the ones guarding the largest exposure.
Why one reviewer is one layer
James Reason's model of complex-system failure holds that accidents rarely have a single cause. Defenses are layered, each has gaps, and failure occurs when the gaps align. Most gaps are latent — introduced long before the incident by decisions that looked reasonable at the time.
Two consequences. A single reviewer is one layer, and its gaps are consistent, because the same person misses the same kinds of things. And most approval failures are latent conditions rather than lapses — the reviewer who misses something was usually set up to miss it, by volume, by a tier assigned for convenience, or by authority granted before anyone knew how the role would fail.