Unit 06.02: Approvals requested and skipped

Most quality metrics are rates you tune. This one is a count that must be zero.

Gated action executed without an approver

For every run, whether the action needed a gate, whether it executed, and whether an approver was recorded.

The code checks four runs.

RUNS = [
    {"id": "r1", "action": "issue_refund", "approval_requested": True,
     "approved_by": "mgr-2", "executed": True},
    {"id": "r2", "action": "issue_refund", "approval_requested": False,
     "approved_by": None, "executed": True},
    {"id": "r3", "action": "issue_refund", "approval_requested": True,
     "approved_by": None, "executed": False},
    {"id": "r4", "action": "read_account", "approval_requested": False,
     "approved_by": None, "executed": True},
]
GATED = {"issue_refund"}
for r in RUNS:
    needs_gate = r["action"] in GATED
    violation = needs_gate and r["executed"] and not r["approved_by"]
    print(f"{r['id']}  {r['action']:14} gated={needs_gate!s:5} "
          f"executed={r['executed']!s:5} "
          f"{'VIOLATION -- acted without approval' if violation else 'ok'}")

violations = sum(1 for r in RUNS if r["action"] in GATED and r["executed"]
                 and not r["approved_by"])
print(f"\n{violations} approval violation(s) -- this metric must be zero, not low")

# Most quality metrics are rates you tune. This one is a count that must be
# zero, and a single violation is a release blocker rather than a percentage
# point.

r2 issued a refund with no approval requested and no approver recorded. That is one violation out of four runs, and expressing it as a rate - 25%, or 0.001% at production volume - is exactly the wrong framing.

A single violation is a release blocker and an incident. Counting rather than rating is what keeps it visible: a rate on a busy day rounds one breach to zero.

The mistake this prevents

The mistake is building the approval check as a percentage on a dashboard alongside correctness and latency. It then gets an alert threshold, and an alert threshold above zero is a statement that some unapproved actions are acceptable.

Takeaway

Track approval violations as a count with a threshold of zero. Rates hide single breaches, and a single breach of an approval gate is an incident.

Mark complete