A platform architect is designing guardrails for an agent that spans the full SDLC pipeline: planning, implementation, testing, code review, and deployment. The team wants to minimize unnecessary human interruptions while maintaining safety. Which guardrail placement strategy is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of guardrails like a staircase with a railing — you don't need someone holding your hand on every step, but you definitely want the railing at the edge of the balcony. Automated checks are excellent gates for reversible transitions (fail a test, block the merge — no harm done). Human judgment is reserved for irreversible actions, specifically pushing code to production, where 'undo' means an incident, a rollback procedure, and potentially customer impact.
Full explanation below image
Full Explanation
Guardrail design in SDLC pipelines must balance safety with throughput. Over-gating kills adoption; under-gating enables runaway agents. The key principle is matching the gate type to the reversibility of the transition.
Option A (human approval at every transition) creates pipeline paralysis. If humans must approve plan→implement, implement→test, test→review, and review→deploy, the agent becomes an expensive typing assistant. Engineers spend more time approving than reviewing, and the human cognitive load is indistinguishable from manual work.
Option B is correct because it applies the irreversibility principle: transitions that can be reversed automatically (failed test blocks merge — no lasting harm) should use automated gates (test pass, lint, SAST scan). The only transition that warrants human approval is the one where the action becomes difficult to reverse: deploying to production. A production deployment affects real users, may require coordinated rollback, and creates customer-visible incidents. That is the correct placement for a human gate. Automated checks at earlier stages are not 'less rigorous' — they are frequently more consistent than human review for mechanical checks (test coverage thresholds, security scan findings).
Option C (no human gates, rely on rollback) conflates the ability to roll back with the acceptability of needing to roll back. Production incidents cause customer impact, SLA violations, on-call pages, and reputational damage even when rollback is fast. Automated rollback is a recovery mechanism, not a substitute for a deployment approval gate.
Option D (gate only at planning phase) misidentifies where the highest-stakes irreversibility occurs. Planning decisions can be revised cheaply. Production deployments cannot. Early-stage gating with no late-stage gating is inverted risk management.