Designing Human Review Gates

A gate is more than a signature

Many review requirements are really attestation requirements: someone confirms a step occurred. That has a purpose, but it is not the same as review. A review gate exists to catch a specific class of error before it propagates.

Naming the error the gate is meant to catch is the fastest way to tell whether it is designed well.

Four properties of a gate that works

• Placement — it sits before the point of no return, not after the record has been finalized or the person has been routed.
• Sufficiency — the reviewer can see what they need without leaving the workflow or reassembling context.
• Consequence — there is a defined action for a failed review: correct, escalate, reassign, or stop.
• Capacity — the volume reaching the gate is within what the assigned role can actually review at the required depth.

Full, sampled, and triggered review

Most durable systems use all three at different points. Choosing one everywhere is usually a sign the gate was designed by policy convenience rather than by consequence.

• Full review — every item. Appropriate where consequence is high and volume is manageable.
• Sampled review — a defined proportion, used to monitor quality and calibrate the rest of the system rather than to catch every case.
• Triggered review — everything meeting defined conditions, such as risk indicators, exceptions, overrides, or new staff within an onboarding period.

Exceptions, overrides, and escalation

Every gate produces exceptions. If there is no defined path for them, they resolve informally and invisibly, which is where most governance failures begin. Specify who may override, what is recorded when they do, and what receives a second look.

Escalation should name a role and a timeframe, not a general direction. "Escalate to clinical leadership" is not operable; "escalate to the on-call supervisor within one business day" is.

Reviewing the gates themselves

Gates accumulate. Periodic review should ask which gates have caught something in the last cycle, which have never produced a correction, and where reviewers are approving faster than the task could reasonably be evaluated. Retiring a gate that does no work is part of maintaining the ones that do.