Which credential reads in an estate genuinely earn a human approval gate, given that an approver can be asleep?
answer
- plan against the tail, not the median
- high blast radius, low frequency
- no person in an unattended path
- pool spanning time zones, stated escalation
- an unaffordable gate breeds hidden copies
basics
~20 sGate the reads that a person performs rarely against material with a large blast radius. Everything unattended or frequent is controlled by narrow scope and per-consumer credentials instead, because a human in that path is an availability incident waiting for a schedule.
solid answer
~50 sThe gate is paid for out of the request path: time-to-access becomes an approver's response time, and that distribution has a long tail — asleep, on leave, in a meeting, one time zone. Plan against the tail, not the median. So gate where blast radius is high and frequency is low: that cell has the smallest availability cost, the largest benefit, and it is the only one where approvers still have the capacity to think. Unattended paths — a nightly export, a service starting during a fleet restart, a job retrying at two in the morning — must never sit behind a person; they get the narrowest scope and a credential minted for that consumer alone. Then design the pool before you need it: several approvers across time zones, a stated escalation, and a separate emergency route for when the approvers themselves are unreachable.
go deeper
Recall that a human approval step costs waiting time, and that anything running unattended at night has nobody to wait for.
Explain the placement rule in terms of who reads the value and how often, and why an unattended path needs scope and per-consumer credentials rather than a person.
Give the operational design: pool across time zones, quorum, escalation after a stated interval, and the tail latency that work behind the gate must live with.
Own the trade explicitly — which classes of access are gated, the availability number committed to, what the ungated paths get instead, and how you will notice the control decaying or being routed around.
## The gate is paid for out of the request path A human approval gate does not cost money. It costs **time-to-access**, and it moves that number out of the system and into somebody's calendar. The resulting distribution has a long right tail by construction: the approver is asleep, on leave, in a meeting, in a different time zone, or has notifications muted. Any commitment made about this gate has to be a tail number. Make the arithmetic explicit, because a lead is expected to. Suppose the median approval takes four minutes and the ninety-fifth percentile takes three hours. Then three hours — not four minutes — is what the estate must plan against, and **any work with a deadline tighter than three hours cannot depend on this gate**. That single sentence decides most of the placement question. ## Which reads earn it | axis | the gate is worth it when | the gate is a mistake when | |---|---|---| | who reads | a named human, present and waiting | an unattended process at an hour nobody watches | | blast radius | customer data, money, production identity | one non-production dependency | | frequency | a few times a month | several times a day | | is later review enough | the damage is done before anyone reviews | the read is low-consequence and review catches it | The axes multiply. Gate where blast radius is large **and** frequency is low. That is the cell where the availability cost is smallest and the benefit largest, and — the part that is usually forgotten — it is the only cell where the approver retains the capacity to actually think about the request. Capacity to think is the thing being bought; spending it on routine traffic spends it on nothing. ## Which reads must never sit behind it An unattended path cannot wait for a person. A scheduled export at two in the morning, a service fetching a credential during a fleet restart, a job retrying after a transient failure: put a person in front of any of these and a credential-exposure risk has been converted into an availability incident, on a schedule, with nobody awake to clear it. Those paths get a different set of controls — the narrowest scope that works, a credential minted for that consumer alone so that withdrawing it is a local act, and an expiry that does not depend on anybody being reachable. ## Design the pool before you need it 1. **Name the pool in advance** and spread it across time zones, so it is never empty at three in the morning. 2. **Choose the quorum against what the material is worth**, and size the pool so that the quorum is still reachable at the worst hour. 3. **State an escalation**: after a stated number of minutes with no answer, the request goes to a second pool. A stalled request must have a defined next step rather than a person chasing colleagues. 4. **Forbid self-approval through any identity the requester holds**, including shared roles and service identities. 5. **Keep the emergency route separate.** The case where the approvers themselves are unreachable is a different mechanism with its own alarm and its own review, and folding it into this one gives you a gate that quietly opens for anybody who claims urgency. ## The bill nobody puts on the invoice If asking is expensive enough, people stop asking, and the forms that takes are predictable: - a value copied out during the last approved window and kept in a local file; - a colleague who still holds a standing grant being asked to do the read; - a script that caches the credential between runs so the gate is only hit weekly. Each of those moves exposure from somewhere the estate can see to somewhere it cannot, which is worse than the visible standing grant the gate replaced. A lead owning this control watches the workaround rate as closely as the denial rate, and treats a spike in either as a signal about placement rather than about discipline. ## What a lead is expected to state A credible answer names: the classes of read that are gated and why; the pool, the quorum and the escalation; the tail latency the estate is committing to; what the unattended paths get instead of a person; the separate emergency route; and how decay will be detected. A candidate who says *approve everything, least privilege* has not costed the control. A candidate who says *automate the approver* has removed the judgment and kept the ceremony, which is the worst of both.
- A team wants the gate on every credential read in the estate. What do you tell them?That they are about to spend their approvers' attention on routine traffic and their availability on jobs nobody is awake to unblock. Within weeks every request is waved through, so the high-value reads that needed real scrutiny get the same two seconds as everything else. Gate the rare, heavy reads; scope the rest.
- How do you keep the gate usable across time zones without weakening it?Size the pool so that the required quorum is reachable at any hour, drawn from teams that do not all sleep at once, and add an escalation to a second pool after a stated interval. The quorum count is the security dial; the pool size and the escalation are the availability dials, and they move independently.
- What measurement tells you the gate was placed wrongly rather than merely being slow?Requests per requester per week. A gate on exceptional access sees a handful; a gate that sees the same person several times a day is sitting on routine work. Pair it with the workaround signals — credentials being read once and reused for days — which indicate people have already routed around it.
saying these in an interview costs you the question
- Puts a human approver in front of a scheduled unattended job
- Quotes the median approval time as the availability commitment
- Gates every credential read on the grounds of least privilege
- Assumes engineers will absorb the delay rather than route around it
- Folds the emergency route into the ordinary approval path
- Pre-approves access each morning to remove the wait