Key takeaways
- Approval rate is almost useless alone. Pair it with override precision: how often a rejection or edit prevented a defined bad outcome.
- Measure the whole service-time distribution, not an average. The 95th percentile and expiry rate reveal the small set of requests that quietly stop the workflow.
- Track coverage by risk tier so a falling review rate is not mistaken for improvement when risky actions are bypassing the gate.
- Reviewer agreement belongs in periodic blinded calibration, not production double-review of every item. Disagreement identifies an unclear policy or evidence packet.
- A gate should earn its cost. Retire, narrow or redesign gates with sustained low catch value, high latency and a safe automatic path proven through sampling.
Use a metric tree instead of one approval rate
| Branch | Question | Core measures |
|---|---|---|
| Protection | Did risky actions reach the intended control? | Gate coverage, bypass rate, sampled miss rate, safe-stop rate |
| Decision quality | Did human judgment improve the proposed effect? | Edit rate, rejection rate, override precision, calibration agreement |
| Service health | Can work get through the gate predictably? | Median and p95 decision time, expiry rate, escalation rate, resume failures |
| Attention cost | Is the control worth the review capacity it consumes? | Requests per reviewer, review minutes, evidence-opening rate, low-value approvals |
NIST's AI RMF says metrics should start with the most significant mapped risks and that deployed behavior should be monitored. Its human-AI appendix specifically identifies override frequency and rationale as useful operational data. That is the right order: name the harm the gate is meant to prevent, then choose the measure. Do not start with whatever timestamp is easiest to query.
Define the measures so the denominator cannot drift
| Metric | Formula | What a bad movement can mean |
|---|---|---|
| Gate coverage | gated eligible actions / all eligible actions | Falling coverage may mean routing bypass, not efficiency |
| Intervention rate | (edits + rejections) / decided requests | Near zero can mean excellent proposals or rubber-stamping |
| Override precision | validated preventions / edits and rejections reviewed | Low precision means the gate flags cases that do not matter |
| Expiry rate | expired requests / requests created | Capacity, routing, notification or deadline mismatch |
| p95 decision time | 95th percentile of decision_at - presented_at | A minority of work is stuck even when the median looks healthy |
| Resume failure rate | failed or duplicate resumes / accepted decisions | The approval service works, but the controlled workflow does not |
| Sampled miss rate | risky ungated actions found / automatic actions sampled | The gate trigger is failing to identify eligible work |
Worked week: 1,000 proposed account updates
A workflow proposes 1,000 CRM updates. Policy says 180 are eligible for review because they overwrite a verified field or contain conflicting sources. The system creates 176 requests: coverage is 97.8%, and the four bypasses need investigation before anyone celebrates lower queue volume.
Reviewers approve 120 unchanged, edit 32, reject 18 and let six expire. The intervention rate is 29.4% of 170 decided requests. A weekly outcome review finds that 38 of the 50 interventions prevented an incorrect segment or preserved the existing verified value, giving 76% override precision under this deliberately narrow definition.
Median decision time is 11 minutes, but p95 is four hours and all six expiries belong to one region after its reviewer's shift ends. The queue does not need a faster global target. It needs an owned after-hours route in that region.
A sample of 80 ungated updates finds two cases that should have been gated, a 2.5% sampled miss rate. Those two misses matter more than the 70.6% unchanged approval rate because they reveal a hole in the trigger.
Collect events that let you separate queue delay from execution delay
One created timestamp and one approved timestamp are not enough. Record when the proposal became eligible, when the request was created, when the reviewer could actually see it, when they decided, when the workflow resumed and when the effect completed. Keep proposal version, gate rule, risk tier and reviewer role on the same run.
The audit-trail event envelope provides the underlying record. Calculate metrics from immutable events rather than mutable request rows; otherwise an escalation or edit can overwrite the history the metric is meant to explain.
eligible: the action met a named gate rule.requested: a versioned proposal and authority set were stored.presented: the review surface became available to an eligible person.decided: outcome, actor, reason and proposal version were accepted.expiredorescalated: the time policy changed ownership or state.resumedandeffect_completed: the decision produced one bounded result.
Use calibration samples to distinguish policy ambiguity from reviewer error
Select a small, stratified set of past requests and have qualified reviewers decide independently without seeing the original outcome. Compare agreement by gate rule and risk tier. Frequent disagreement can mean the evidence packet hides the deciding fact, the policy leaves a real gap or the reviewers use different standards.
Do not turn every production request into a double-review merely to obtain an agreement metric. That doubles attention cost and may still produce correlated errors. Calibration is a periodic diagnostic. High-consequence processes may independently require more than one approver, but that is a control decision rather than a measurement shortcut.
Run a weekly queue review and a slower control review
| Cadence | Look at | Decision |
|---|---|---|
| Daily | Expiries, oldest pending, unavailable reviewers, resume failures | Restore service and move stuck work safely |
| Weekly | Coverage, p95 time, interventions, sampled misses by gate | Fix routing, capacity or evidence packets |
| Monthly | Override precision, calibration, post-decision outcomes, attention cost | Narrow, strengthen, redesign or retain the gate |
| After material change | Trigger tests, reviewer authority, expiry and duplicate-resume tests | Revalidate before returning to normal operation |
Limitations and when not to use this
- Override precision requires a defensible outcome label. If the avoided harm cannot be observed, report the limitation instead of inventing a proxy that always makes the gate look useful.
- Rates from small queues are volatile. Always show counts and time windows, and avoid comparing reviewers whose case mix or authority differs.
- Metrics can create pressure to approve quickly or avoid difficult cases. Never use decision time or approval rate as an individual performance target without accounting for risk, complexity and quality.
Sources
- AI Risk Management Framework Core — NIST Accessed 30 July 2026
- AI RMF Appendix C: AI Risk Management and Human-AI Interaction — NIST Accessed 30 July 2026
- Guidelines for Human-AI Interaction — Microsoft HAX Toolkit Accessed 30 July 2026
Instrument one gate
Add proposal, presented, decision, expired and effect events before building a dashboard from incomplete timestamps.
Instrument one gateUli Prantz
Builds and operates all-agents
Uli Prantz builds all-agents, the process-automation platform this site documents. He writes about the operational side of automating recurring business work: where deterministic code beats model judgment, where it does not, and where a human still has to approve.