Principles Library / Proportional oversight

Proportional oversight

Oversight Must Be Proportional to Risk, Not to the Type of Actor

Act

Showing all 4 practices. Answer the Diagnose questions and the most relevant come first.

Match each change class to a control

Sort changes by how bad a failure would be and how easily it's reversed. Match each class to a control, such as automated tests, staged rollout, targeted review, or senior review with a rollback plan.

Start by asking your team: What's the worst outcome if this change fails, and how quickly can it be reversed?

Avoid · You’ll know it’s working when

Avoid

Approval tiers based on seniority
Approval tiers based on tooling

You’ll know it’s working when

Low-risk and high-risk changes take different paths, and approvers see few enough items to examine each one.

Base likelihood on each actor's track record

Adjust likelihood using evidence of an actor's actual failure rate on this kind of change. The actor's type doesn't count as evidence. A good record never lowers the control a high-consequence change needs.

Start by asking your team: What evidence do we have that this actor's changes fail more often?

Avoid · You’ll know it’s working when

Avoid

Treating a trusted actor's high-risk change as low-risk

You’ll know it’s working when

Approval rules draw on an actor's record with this kind of change, and trusted actors' risky changes still get full review.

Retest approval rules against the delay they add

Review approval rules on a regular cycle. Keep each one only if it still cuts risk in proportion to the delay it adds.

Start by asking your team: Would this control have caught the incident it was created after?

Avoid · You’ll know it’s working when

Avoid

Blanket approval after a single incident

You’ll know it’s working when

Approvers send back the changes that need it, and people label their changes honestly.

Separate regulatory requirements from internal habits

In every approval process, mark which steps regulation requires and which ones are internal additions.

Start by asking your team: Which part of this approval does regulation require, and which part is our own habit?

Avoid · You’ll know it’s working when

Avoid

Calling an internal habit "regulatory"

You’ll know it’s working when

Anyone citing compliance as the reason for an approval can name the regulation.

Overview

Principle intent

Put scrutiny where failure would cost the most, so controls protect what matters and don't slow everything else.

Read the full intent

Risk has two parts, how bad a failure would be and how likely it is. The type of actor isn't evidence of either. An actor's track record is. And a person stays accountable for the outcome whatever control the change went through.

When it holds: what it does for you

Faster low-risk work

Low-risk changes go through light controls instead of waiting in the senior sign-off queue.

Scrutiny where it counts

High-risk changes get a review that actually examines them, whoever made them.

Controls people respect

Each control earns the delay it adds, so people have less reason to work around it.

When it is ignored: from early signs to a lasting condition

Early warning signs · Visible now, cheap to fix

Approval rules name a type of actor, such as "all vendor changes."
Low-risk and high-risk changes wait in the same approval queue.
A senior's change skips review even when it is hard to reverse.

What happens over time · Accumulates, costly to reverse

Low-risk work is delayed with no matching drop in risk.
Approvers see so many changes that they sign off without examining them.
High-risk changes from a "trusted" actor get too little scrutiny.

The condition it becomes

Governance Drag · Primary

Work is done. Approvals are not.

How this principle feeds it

approval layers that add delay without proportional reduction in risk are the library's definition.

Oversight Erosion · Primary

The review process still runs. It stopped meaning anything.

How this principle feeds it

review that still runs but no longer examines anything is the condition's signal line.

Where is your system on this path?

Diagnose

AI signs are on by default. Use the AI switch to exclude them.

1. Which of these early warning signs are you seeing?

Approval rules name a type of actor, such as "all vendor changes."
Low-risk and high-risk changes wait in the same approval queue.
People avoid a label because it triggers review.
Approvers handle many items a day and rarely reject any.
An approval is "required for compliance," and nobody can name the regulation.
After an incident, every change of that kind needs approval, whatever its risk.
A senior's change skips review even when it is hard to reverse.
Every AI-assisted change needs human sign-off so someone stays accountable. (AI)
People have stopped marking changes as AI-assisted. (AI)

2. Over the last few months, have you noticed…

For each consequence: Not seen / Sometimes / Persistently / Not sure.

Low-risk work is delayed with no matching drop in risk.
Approvers see so many changes that they sign off without examining them.
High-risk changes from a "trusted" actor get too little scrutiny.
Teams work around controls, so real protection is lower than before.
Reviewers spend most of their time on routine changes from distrusted types of actor.

3. The condition it becomes

Based on your answers, recognize at most two conditions: No / Partly / Yes, that is us.

Governance Drag: Work is done. Approvals are not.

Oversight Erosion: The review process still runs. It stopped meaning anything.

Take your Diagnosis to the next level by invoking AI Diagnostic Coaching tool.

What else have you observed? Optional. Shared only if you choose to start coaching.

Start a Diagnosis session: review and edit a draft containing your note, conditions you recognized in Step 3 (including whether they match partly), warning signs and consequence ratings before sending it. No scores or principle files are sent.

See what practices will help you