Management by Exception: The Trust Record Lowers the Gate

Intercom auto-approves over 19% of pull requests with no human reviewer and routes the other 81% through a gate: a gate comes down only for the class of work the evidence has shown is safe to let through, and everything else still stops for a human. The discipline has a name borrowed from operations management, management by exception: define a tolerance band, let anything inside it proceed automatically, and spend scarce human attention only on what falls outside. Earlier chapters built the gate (Review as a Gate), kept its authority honest (Author, Never Approver), and decided which classes of change can skip the human (Auto-Approval by Risk). The intervention record, trending down, is the evidence that earns the next reduction.

The principle is older than agents, and it is not "remove the gate"

Management by exception predates AI by decades. It is the management discipline of setting a tolerance band for a process, automating the in-tolerance path, and escalating only out-of-tolerance events to a human. Applied to agent-written code, the tolerance band is a risk class plus a measured failure rate, the in-tolerance path is auto-approval, and the exception is anything the classifier cannot clear: too large, too risky a surface, or an engineer's explicit request for review.

The distinction that keeps this from collapsing into "ship without review" is that the gate does not disappear. It narrows. Intercom's reviewer refuses to approve large PRs: oversized changes are flagged and broken down, which is scope discipline acting as the boundary of the tolerance band. Any engineer can request a human review on any change, at any time. The exception path is always open, and the human stays accountable for what ships, which is the rule Accountability Stays Human builds on. Management by exception reallocates human attention; it does not retire it.

The trust record is the trigger to lower a gate

You do not lower a gate on a hunch. You lower it when the record shows the work inside a class clears the bar without a human, and you can point an auditor at the numbers. Intercom is the only team in the three reports that has published the before-and-after.

The record they lowered the gate on:

The sequence matters. The pilot produced the zero-revert evidence first; the auto-approval class expanded second. The intervention rate fell, the gate came down for that class, and the new record was watched to confirm it held. Reverting roughly 10x less often than the human-authored baseline is the kind of measured signal that justifies widening the exemption, and it is the signal the intervention-rate metric is built to track over time. Where outcome quality holds steady and the intervention rate keeps falling, the next class becomes a candidate to move inside the band.

This is also why the expansion is class by class rather than a single global setting. Auto-approval by risk decides which class skips the human; the trust record decides when a class has earned the move. Coinbase's defensible public position, per the best available secondary sourcing, is the conservative version of the same move: auto-merge only for low-risk classes (copy changes, minor bug fixes), with everything riskier still routed to a human (Auto-Approval by Risk traces what that record does and does not support).

A falling intervention rate is necessary, not sufficient

The trigger is gameable, and a low intervention rate is the wrong target if quality is dropping. The same dynamic that erodes a manual gate erodes an automated tolerance band: a rate can fall because the work genuinely improved, or because the bar quietly dropped. Approval Fatigue is the manual version of that failure, where the audit log still reads "approved by human" on every line while the reading rate falls to zero. An auto-approval band has the same exposure one level up: if you tune for fewer interventions without watching the outcome, you optimize the metric and lose the thing it was supposed to measure.

The guard is to pair the intervention rate with an outcome rate and never read either alone. Intervention rate shows how much human steering the work still needs; the outcome rate (revert rate, escaped defects, time-in-production behavior) shows whether the work is actually good. A gate reduction is justified only when the intervention rate falls and the outcome rate holds. That pairing is the subject of Measuring Human Intervention and Measuring Outcomes, and it is the reason this discipline is a reporting practice, not a config flag.

The band holds only on top of the environment this section already built

Management by exception is a downstream control. It works because the upstream machinery makes the in-tolerance path safe to automate: closed feedback loops so the agent reads its own CI and review-bot output instead of stalling, verifiable outcomes so "in tolerance" means something a test can confirm rather than a model's confidence, and small scopes so the blast radius of a missed exception stays bounded. DORA's 2025 finding is the same point from the research side: AI amplifies an organization's existing strengths and weaknesses, and the teams that gain are the ones with "strong automated testing, mature version control practices, and fast feedback loops." Lower a gate without those, and you are not managing by exception. You are removing a control and calling the silence a result.

Where the corpus is thin

The principle is stated here as prescription, the same way the seven-properties pages fence their claims, because the public record supports the trigger pattern but not a settled threshold. Intercom published the trust record that justified its expansion; nobody has published the decision rule (how low an intervention rate, held for how long, before a class moves inside the band), and the field publishes generation numbers far more readily than the intervention-rate and outcome-rate series this discipline runs on. Treat the threshold and the cadence as working agreements your team writes and records, not settled practice, and treat "the gate came down because the evidence said so" as a claim you must be able to show an auditor, not assert.