Module 6 of 8
Controls
Add approvals, logging, and fallback paths.
Consequential actions need a person in the loop: anything that contacts a customer, moves money, commits a resource or is hard to reverse. Put the approval where the decision actually is, not at the end where the reviewer is rubber-stamping work already done.
Then design the fallback. What happens when the model is unavailable, the input is unreadable, or the confidence is low? "Nothing happens and someone is told" is a perfectly good answer, and far better than the common alternative, which is that the run fails silently and nobody notices for a week.
Takeaway
Approval at the decision, not after it. Design what happens on failure — silent failure is the real risk.