System · Build & Ship
An approval step thatauto-approves is a delay,not a control.
Nearly every team can point at a human review step. Far fewer can say what happens when that step does not answer — and the honest answer is often that the action goes through anyway, on a timer nobody chose deliberately. This System grades the thing behind your check: who owns it, whether they are reachable, what they are handed, and above all what happens on a timeout.
Deterministic and offline. Scores the marks you enter; tests no live system.
Grades the path — never people, and never the reviewer.
Instant download. Python engine, workbook, two playbooks, worked portfolio.
01
Six controls, and only five of them trade
A strong evidence packet really does make up for a slower response window. Nothing makes up for a timeout that approves.
A named owner
18
A person or a published rota with a named backup — not a shared inbox nobody is accountable for.
Reachable inside the window
18
A response window matched to how time-sensitive the action is, and actually met.
What happens when nobody answers
16 · gate
Held and escalated on a clock, held indefinitely, or proceeds on its own. Only the last one is dispositive.
The reviewer gets enough to decide
18
Inputs, the proposed action, which rule failed, and the downside of approving anyway.
Overrides are recorded
15
Who approved it, when, and the stated reason — distinguishable from a normal approval.
Rejections teach something
15
Returned with the failed rule, and the pattern reviewed on a cadence rather than counted and forgotten.
Why the gate is not simply the heaviest weight
Because a heavy weight would only make a fail-open path score lower, and a strong enough path would still score its way past it. Making it dispositive is the honest expression of what it does, so it carries a middling weight of 16 and the gate does the work. Weighting it heavily as well would be counting the same fact twice.
02
Move one mark and watch the verdict flip
Set P-01’s timeout control to 1 and it clears. Set it back and 84 out of 100 fails open again.
P-01 · Refund over threshold
FAILS OPEN
Scores 84/100, which bands as FAILS CLOSED. The gate overrides it: an unanswered request proceeds on its own, so this is a delay rather than a control. Fix first: What happens when nobody answers.
A named ownerweight 18
Reachable inside the window the action needsweight 18
What happens when nobody answersweight 16gate
The reviewer gets enough to decideweight 18
Overrides are recordedweight 15
Rejections teach somethingweight 15
Portfolio verdict
NO BACKSTOP
2 closed · 1 soft · 3 open, of 6. Mean score 66 — context only, it decides nothing. Fix first: P-06.
Same arithmetic as the shipped engine and workbook. It grades the paths you describe, never people, and tests no live system.
03
What the engine prints
This is the shipped engine’s complete output on the shipped portfolio.
VALIDATION-FAILURE BACKSTOP
==========================================================================
P-01 Refund over threshold
score 84/100 band FAILS CLOSED FAILS OPEN
named_owner=2 reachable_in_sla=2 timeout_behavior=0 evidence_packet=2 override_logged=2 rejection_feedback=2
[GATE] an unanswered request proceeds on its own - this is a delay, not a control
scored 84 and banded FAILS CLOSED; the gate overrides it
fix first: What happens when nobody answers
P-02 Refund over threshold (hardened)
score 100/100 band FAILS CLOSED FAILS CLOSED
named_owner=2 reachable_in_sla=2 timeout_behavior=2 evidence_packet=2 override_logged=2 rejection_feedback=2
every control at full - nothing to fix
P-03 Vendor payout hold
score 68/100 band FAILS SOFT FAILS SOFT
named_owner=2 reachable_in_sla=1 timeout_behavior=1 evidence_packet=2 override_logged=1 rejection_feedback=1
fix first: What happens when nobody answers
P-04 Access grant request
score 34/100 band FAILS OPEN FAILS OPEN
named_owner=0 reachable_in_sla=1 timeout_behavior=1 evidence_packet=1 override_logged=0 rejection_feedback=1
fix first: A named owner
P-05 Order status correction
score 93/100 band FAILS CLOSED FAILS CLOSED
named_owner=2 reachable_in_sla=2 timeout_behavior=2 evidence_packet=2 override_logged=1 rejection_feedback=2
fix first: Overrides are recorded
P-06 Bulk customer email
score 18/100 band FAILS OPEN FAILS OPEN
named_owner=1 reachable_in_sla=0 timeout_behavior=0 evidence_packet=1 override_logged=0 rejection_feedback=0
[GATE] an unanswered request proceeds on its own - this is a delay, not a control
fix first: What happens when nobody answers
--------------------------------------------------------------------------
PORTFOLIO VERDICT: NO BACKSTOP
2 closed / 1 soft / 3 open (of 6 paths)
mean score 66 -- context only, it decides nothing
gate fired on 2 path(s) (timeout_behavior)
fix first: P-06 -- timeout_behavior
Grades the paths you describe. Not legal, security, or compliance advice.P-01 and P-02 are the same refund approval, one mark apart. P-01 scores 84, bands as FAILS CLOSED, and the gate overrides it. P-02 changes the timeout behaviour and clears at 100. Note also P-06: the gate fires there too, but it was already failing open on score alone, so the gate is not credited with work it did not do. And the portfolio mean is 66 — a perfectly respectable-looking number attached to a set of paths that reads NO BACKSTOP.
04
What is inside
Six files, all editable, none requiring an account.
Scoring engine
Zero-dependency Python. Reads your marks, prints a score, a pre-gate band, and a verdict per path. No network access of any kind.
Editable control set
A JSON file holding the six controls, their weights, and what each mark means. Change a weight, reword a mark, or add a control — the engine checks the weights still sum to 100.
Workbook that reproduces it
Four tabs — Start Here, Controls, Paths, Dashboard — with 88 live formulas and no macros. Opens in Excel, Google Sheets, or Numbers.
Timeout-Design Playbook
How to choose a timeout behaviour per action class, and why "send to manager" is not an escalation architecture.
Fail-Open Runbook
What each verdict means, how to read the 84-and-still-open case, and the three fixes that are usually cheaper than they look.
Worked 6-path portfolio
Including the teaching pair: one path that scores 84 and fails open, and its hardened twin that clears at 92 on a single mark.
05
Who it is for, and what it will not do
It is for whoever will be asked why the action went through.
Built for
- Teams with a human-in-the-loop step they have never actually tested by not answering it.
- Anyone whose approval queue has grown until nobody reads it, which is a queue that approves everything slowly.
- Operators who need a defensible reason to say a control is not real yet, rather than a feeling that it is thin.
It will not
- Connect to your queue, your alerting, or your approval tooling. You describe the path; it grades the description.
- Test whether your timeout actually behaves as you marked it. That is a drill you run, and the playbook says how.
- Score the reviewer. Ownership is graded as a property of the path, never as a judgement about a person.
- Tell you a FAILS CLOSED path is safe. It tells you the backstop is designed, not that it has ever caught anything.
This System grades the design of a validation path from marks you enter. It is a working aid, not legal, security, or compliance advice, and it is not an audit or a certification. It never scores, ranks, or assesses people — including reviewers — and must not be used for performance or employment decisions.
06
What sits either side of it
Three neighbours that touch the same escalation step from different angles.
AI Agent Go-Live Readiness Gate
$79
Asks whether a human escalation path exists, as one control among five. This assumes it does and asks whether it works.
Out-of-Band Payment Verification Readiness Gate
$79
The approval controls around a payment specifically. This is the general shape, for any action a check can reject.
Agent-Executable SOP Readiness Gate
$79
Whether a procedure has a stop condition at all. This grades what the stop condition actually does when it fires.
07
Questions people actually ask
Short answers first, with the caveat after it rather than in front of it.
What happens after a check says no. For each validation path you mark six controls 0, 1 or 2 — a named owner, reachability inside the window the action needs, what happens when nobody answers, whether the reviewer gets enough to decide, whether overrides are recorded, and whether rejections teach anything. It returns FAILS CLOSED, FAILS SOFT, or FAILS OPEN per path, and a portfolio verdict.
Because one of the six controls is not tradeable. If an unanswered request proceeds on its own, the review step is a delay rather than a control, and no amount of good ownership, fast SLAs, or clean logging changes that. 84 is the highest score reachable while that control sits at zero, and the shipped sample contains exactly that path — with its hardened twin on the next row, which clears at 92 by changing one mark.
Because weighting it heavily would double-count it and still not work. A heavy weight only makes a fail-open path score lower; it would still let a strong enough path score its way past the problem. Making it dispositive is the honest expression of what it does, so it carries a deliberately middling weight of 16 and the gate does the rest. Every other control is genuinely additive and the score treats them that way.
A go-live check asks whether a human escalation path exists — one control among several, answered yes or no. This assumes it exists and asks whether it works: who owns it, whether they are reachable in time, what the reviewer is handed, and above all what happens on a timeout. In practice the path exists almost everywhere and fails open almost as often, which is the gap this was built for.
Never. The portfolio takes the worst path. The shipped sample averages 66 across six paths and reads NO BACKSTOP, because three of them fail open. The mean is printed for context and is labelled as such in the engine, the workbook and the demo.
No. It grades the design of a validation path from marks you enter. Reviewers appear as a role — whether an owner is named, whether they are reachable — never as individuals being assessed, and there is no score attached to any person anywhere in the engine or workbook. It must not be used for performance or employment decisions. A working aid, not legal, security, or compliance advice, and not an audit.
Find out what your check does when nobody answers.
Six controls, one dispositive. Deterministic, offline, and honest that a designed backstop is not the same as a tested one.
This System grades the design of a validation path from marks you enter. A working aid, not legal, security, or compliance advice, and it never scores or ranks people, including reviewers.
Sold by RedHub AI LLC · Secured by Stripe · redhub.ai