Risk-Calibrated Action Gate
Match governance strength to action risk before execution. Low-risk, reversible actions may proceed under policy alone; higher-risk or irreversible actions require stronger evidence, approval, escalation, dual control, or denial. The gate is enforced by action rights, execution mode, risk tiers, approval modes, tier ceilings, and approval requirements, not by memory or etiquette.
Problem
Systems often govern every action as if it has the same consequence. Either everything needs review, which creates approval fatigue, or too much proceeds automatically, which gives actors more authority than the product can defend.
Context
Use this pattern when a system supports actions with different stakes: read-only queries, internal drafting, workflow updates, external outreach, security changes, financial movement, publication, contracts, reservations, rights changes, or infrastructure mutation.
Forces
- Low-risk, reversible work should not require the same ceremony as irreversible work.
- High-risk work must not rely on a user remembering to ask for approval.
- Actor authority varies by action, mode, and risk tier.
- The same action can require different governance in proposal, dry-run, and execution modes.
- Approval fatigue can make governance weaker.
- Missing governance facts should stop high-risk effects.
- Operators need to explain why an action proceeded, escalated, or stopped.
Solution
Classify actions by risk before they reach execution, then bind the allowed path to that risk tier. Give each actor an explicit action-rights envelope: allowed actions, execution mode, tier ceiling, and approval mode. Low-risk actions may proceed under policy alone. Higher-risk or irreversible actions require stronger evidence, explicit approval, senior review, dual control, a rollback plan, or denial.
The gate is absolute. If the action exceeds the actor's tier ceiling, lacks required approval, lacks required evidence, or cannot verify governance facts, it does not execute. Administrative status does not bypass the gate.
Consequences
Governance becomes proportional and enforceable. Safe work can keep moving, while risky work slows down, escalates, or stops. The recurring question "does this need approval?" becomes a policy lookup instead of an incident-time argument.
Failure Modes
- Every action has the same approval mode.
- Risk tiers exist in documentation but are not enforced at execution.
- Actor roles imply unlimited action authority.
- Admins can bypass tier gates.
- Destructive execution can run in the same mode as planning or dry-run behavior.
- Workers or connectors skip the tier check.
- The system fails open when evidence, approval, or policy services are unavailable.
Proof Points
mode, tier ceilings, and approval requirements; high-risk actions cannot execute without valid approval even for administrators.
governance to the stakes of internal tasks, drafts, outreach, publication, money, contracts, and rights-related actions.
- AISDR — action rights include allowed actions, execution
- SADIE — approval modes and action risk levels calibrate
Full source pattern: risk-calibrated-action-gate.md.