Approval — Who Accepts This?
The third discipline: which outputs may be applied automatically, which need one reviewer, and which need two. Five chapters.
1. Who accepts this, and against what standard?
Approval is the first discipline that touches output — and the first where being wrong ships.
Scope and Context act before the work. Approval is the first discipline that touches output — and the first where the cost of getting it wrong is measured in things that shipped.
Approval — the architecture specifying which AI-produced outputs may be applied automatically, which require one reviewer, and which require two.
| Tier | Applies when | Cost of being wrong |
|---|---|---|
| Auto-apply | Reversible, low-consequence, verifiable after the fact | Recoverable |
| Single reviewer | Consequential but recoverable | Real, bounded |
| Dual review | Irreversible, externally visible, or regulated | Unbounded |
Tier by consequence, not by convenience. The instinct is to tier by how tedious the review is — which produces an architecture optimized for reviewer comfort. That is exactly backwards: the tedious reviews are often the ones guarding the largest exposure.
Why one reviewer is one layer
James Reason's model of complex-system failure holds that accidents rarely have a single cause. Defenses are layered, each has gaps, and failure occurs when the gaps align. Most gaps are latent — introduced long before the incident by decisions that looked reasonable at the time.
Two consequences. A single reviewer is one layer, and its gaps are consistent, because the same person misses the same kinds of things. And most approval failures are latent conditions rather than lapses — the reviewer who misses something was usually set up to miss it, by volume, by a tier assigned for convenience, or by authority granted before anyone knew how the role would fail.