Human approval is not a control when reviewers cannot understand the action or face enough requests to approve reflexively. Reduce volume through policy, not by hiding risk.
Design the review card
Show requester, agent and version, purpose, tool, resource, destination, material before-and-after values, data class, risk, expected side effect, rollback path, evidence link, and expiry. Bind the decision to an action fingerprint so changes require re-review.
Route by risk
| Class | Handling |
|---|---|
| Reversible, low impact | Policy allow with sampling and audit |
| Material but routine | Named queue with clear SLA and bounded batch approval |
| Irreversible, sensitive, or high value | Fresh review, step-up authentication, possible dual control |
| Unknown or changed | Stop and escalate; never inherit prior approval |
Metrics
Track approval rate by action class, decision time, expiry, reversals, reviewer disagreement, incidents after approval, changes that invalidated approval, and queue abandonment. A near-100% approval rate with very short review time is a control-quality warning.