Governance Drag · Primary
Work is done. Approvals are not.
How this principle feeds it
approval layers that add delay without proportional reduction in risk are the library's definition.
Principles Library / Proportional oversight
Proportional oversight
Oversight Must Be Proportional to Risk, Not to the Type of Actor
Diagnose
AI signs are on by default. Use the AI switch to exclude them.
1. Which of these early warning signs are you seeing?
- Approval rules name a type of actor, such as "all vendor changes."
- Low-risk and high-risk changes wait in the same approval queue.
- People avoid a label because it triggers review.
- Approvers handle many items a day and rarely reject any.
- An approval is "required for compliance," and nobody can name the regulation.
- After an incident, every change of that kind needs approval, whatever its risk.
- A senior's change skips review even when it is hard to reverse.
- Every AI-assisted change needs human sign-off so someone stays accountable. (AI)
- People have stopped marking changes as AI-assisted. (AI)
2. Over the last few months, have you noticed…
For each consequence: Not seen / Sometimes / Persistently / Not sure.
- Low-risk work is delayed with no matching drop in risk.
- Approvers see so many changes that they sign off without examining them.
- High-risk changes from a "trusted" actor get too little scrutiny.
- Teams work around controls, so real protection is lower than before.
- Reviewers spend most of their time on routine changes from distrusted types of actor.
3. The condition it becomes
Based on your answers, recognize at most two conditions: No / Partly / Yes, that is us.
Governance Drag: Work is done. Approvals are not.
Oversight Erosion: The review process still runs. It stopped meaning anything.
Take your Diagnosis to the next level by invoking AI Diagnostic Coaching tool.
What else have you observed? Optional. Shared only if you choose to start coaching.
Start a Diagnosis session: review and edit a draft containing your note, conditions you recognized in Step 3 (including whether they match partly), warning signs and consequence ratings before sending it. No scores or principle files are sent.
Overview
Principle intent
Put scrutiny where failure would cost the most, so controls protect what matters and don't slow everything else.
Read the full intent
Risk has two parts, how bad a failure would be and how likely it is. The type of actor isn't evidence of either. An actor's track record is. And a person stays accountable for the outcome whatever control the change went through.
When it holds: what it does for you
Faster low-risk work
Low-risk changes go through light controls instead of waiting in the senior sign-off queue.
Scrutiny where it counts
High-risk changes get a review that actually examines them, whoever made them.
Controls people respect
Each control earns the delay it adds, so people have less reason to work around it.
When it is ignored: from early signs to a lasting condition
Early warning signs · Visible now, cheap to fix
- Approval rules name a type of actor, such as "all vendor changes."
- Low-risk and high-risk changes wait in the same approval queue.
- A senior's change skips review even when it is hard to reverse.
What happens over time · Accumulates, costly to reverse
- Low-risk work is delayed with no matching drop in risk.
- Approvers see so many changes that they sign off without examining them.
- High-risk changes from a "trusted" actor get too little scrutiny.
The condition it becomes
Oversight Erosion · Primary
The review process still runs. It stopped meaning anything.
How this principle feeds it
review that still runs but no longer examines anything is the condition's signal line.
Act
Act
Showing all 4 practices. Answer the Diagnose questions and the most relevant come first.
Match each change class to a control
Sort changes by how bad a failure would be and how easily it's reversed. Match each class to a control, such as automated tests, staged rollout, targeted review, or senior review with a rollback plan.
Start by asking your team: What's the worst outcome if this change fails, and how quickly can it be reversed?
Avoid · You’ll know it’s working when
Avoid
- Approval tiers based on seniority
- Approval tiers based on tooling
You’ll know it’s working when
Low-risk and high-risk changes take different paths, and approvers see few enough items to examine each one.
Base likelihood on each actor's track record
Adjust likelihood using evidence of an actor's actual failure rate on this kind of change. The actor's type doesn't count as evidence. A good record never lowers the control a high-consequence change needs.
Start by asking your team: What evidence do we have that this actor's changes fail more often?
Avoid · You’ll know it’s working when
Avoid
- Treating a trusted actor's high-risk change as low-risk
You’ll know it’s working when
Approval rules draw on an actor's record with this kind of change, and trusted actors' risky changes still get full review.
Retest approval rules against the delay they add
Review approval rules on a regular cycle. Keep each one only if it still cuts risk in proportion to the delay it adds.
Start by asking your team: Would this control have caught the incident it was created after?
Avoid · You’ll know it’s working when
Avoid
- Blanket approval after a single incident
You’ll know it’s working when
Approvers send back the changes that need it, and people label their changes honestly.
Separate regulatory requirements from internal habits
In every approval process, mark which steps regulation requires and which ones are internal additions.
Start by asking your team: Which part of this approval does regulation require, and which part is our own habit?
Avoid · You’ll know it’s working when
Avoid
- Calling an internal habit "regulatory"
You’ll know it’s working when
Anyone citing compliance as the reason for an approval can name the regulation.