The five classes that always need a gate
- Destructive: deleting, voiding, cancelling or archiving records.
- Financial: charging, refunding, issuing credit or changing a price that has been agreed.
- External send: any message, contract or document that leaves the company.
- Bulk: anything applied to many records at once, where a mistake multiplies.
- Override: booking past capacity, skipping a required stage, bypassing a rule.
What a real confirmation looks like
A confirmation that says 'proceed?' is decoration. A usable one shows the specific customer, the specific amount, the exact recipients, and what changes the moment approval is given.
It should also be bound to that exact preview. If the underlying data changed between the preview and the approval, the gate must be re-issued rather than executed against stale facts.
Why over-gating is its own risk
If every read and every note requires approval, people stop reading the prompts and start clicking through them. The gate then protects nothing while still costing time.
Reserve confirmation for consequence. Low-risk reads and internal notes should run immediately, and the audit trail carries the accountability instead.
Confirmation is not the same as autonomy
A confirmed action is still bounded: the user could have done it manually, the permission check still applies, and the entitlement limits still apply. Approval does not widen scope — it authorizes one specific instance of something already permitted.