The Right "No": Where Governance Should Add Friction, and Where It Shouldn't

Governance should slow a decision down only when it is hard to undo or expensive to get wrong. Everywhere else, a gate is just delay that looks like control.

Speed is not the enemy of quality

Most leaders assume every extra approval buys safety. The evidence does not support that. In a McKinsey global survey on decision making, faster decisions tended to be higher quality, which suggests speed does not undercut the merit of a decision. The same survey found only 37 percent of respondents say their organisation's decisions are both high in quality and velocity. The weakest area was not the big bets. Just 46 percent rated their delegated decisions as high quality, against 65 percent for big bets. The small, routine decisions are where weak decision rights hurt most, and that is where most governance friction lands.

Put the friction before the point of no return

Jeff Bezos drew this distinction in Amazon's 2015 shareholder letter: some decisions are one-way doors, consequential and hard to reverse, and these need methodical, deliberate review. Most decisions are two-way doors, changeable and reversible, and a suboptimal call there does not need to be lived with for long. The mistake he flagged is organisations applying one-way-door process to two-way-door decisions, which produces slowness, risk aversion, and less experimentation.

Software delivery maps onto this cleanly. A feature flag rollout is a two-way door. If it breaks something, you flip it off and you are back where you started in minutes. A production database migration that drops a column, or a breaking change to a public API that external customers depend on, is a one-way door. Once it ships, rollback is expensive or impossible, and the people who bear that cost were rarely in the room when the change was approved. Governance that treats both the same way either slows the flag rollout for no reason or waves the schema change through with the same light touch. The gate belongs on the door you cannot walk back through.

Scale the friction to the consequence

NIST's AI Risk Management Framework defines risk as the probability of an event and the magnitude of its consequences, and advises that AI systems with lower risk tolerances receive greater oversight, mitigation and management resources. The principle is proportionality, not uniform caution.

The AI angle

Regulators already apply this logic. The European Commission's approach gives minimal-risk systems, such as spam filters, a free pass with no obligations, while high-risk systems must meet strict requirements including human oversight, logging and detailed documentation. Your AI workstreams should not all go through the same gate. An internal drafting assistant and a model that influences decisions about people are different bets.

The implication

Before adding or keeping any gate, ask three questions:

1. Is this a one-way door or a two-way door?
2. Who pays if it is wrong?
3. What does this gate change that a well-briefed owner would not?

If the answers are two-way, nobody who matters, and nothing, remove the gate. If a change is hard to reverse and the cost lands on someone who never got a vote, that is where the "no" belongs.

A governance framework is judged by the decisions it stops, not by the number it reviews.