# Design your validation gates
> **What you will learn**
> Not a chapter to read but one to **do**. Take one of your own outputs and write
> **the conditions under which it could ship without a human looking**. Whatever
> you cannot write down is exactly why a human is still attached.
## What you need
```
□ 40 minutes
□ One output that actually goes outside
· a code deploy, a document that reaches a customer, an external post
□ One person who reviews it today
□ Paper or a spreadsheet
```
---
## Step 1 — Who looks at what today (10 min)
Write down everything the reviewer **actually checks with their eyes.** Including
"skims it."
| # | What they check | Why | How long |
|---|---|---|---|
| 1 | | | |
| 2 | | | |
| 3 | | | |
```
How to write it:
"checks the quality" ✗ -> write what tells them the quality is bad
"checks the numbers add up" ✓
"checks it sounds like us" ✓
```
**Mark any row whose "why" is blank.** It may be the scar of an old incident, or
it may be habit nobody can account for.
---
## Step 2 — Sort into three (10 min)
Sort each row by **who can decide it.**
| Class | Test | Examples |
|---|---|---|
| **A machine decides** | the answer is true or false | totals, required fields, format, dead links |
| **A machine flags** | it can raise a suspicion | odd tone, unusual values, banned words |
| **Only a person** | needs context and accountability | is this the right thing to say right now |
```
□ Every row from step 1 is in one of the three
□ If "only a person" is more than half -> do step 2 again
```
**That second line is the common outcome.** On the first pass, almost everything
lands in "only a person." Split them once more — "is this document right" needs a
person, but "does the amount match the table" inside it does not.
---
## Step 3 — Stand up three gates (15 min)
Lay them out in the order from [automatic
validation](/guide/ha-phase3-validation).
```
Gate 1 (machine, seconds) : fails -> nothing proceeds at all
Gate 2 (machine, minutes) : fails -> flagged for a person
Gate 3 (person, as needed) : only what gate 2 flagged
```
| Gate | What it checks | On failure |
|---|---|---|
| 1 | | |
| 2 | | |
| 3 | | |
### What every gate must state
```
□ Is the pass condition written in one line?
□ What happens on failure (halt? flag? roll back?)
□ Who gets told
```
**Without the second, it is not a gate — it is a log.** If failing changes
nothing, nobody reads it.
---
## Step 4 — Check the way back (5 min)
One last question.
```
□ If it passed every gate and still went out wrong, how long to undo it?
```
| Answer | What it means |
|---|---|
| Minutes | you can afford loose gates. Ship fast and fix |
| Hours | the design above is about right |
| **It cannot be undone** | **gate 3 with a person is mandatory** |
**The cost of undoing sets the thickness of the gates.** Thick gates on
cheap-to-undo work only cost you speed; thin gates on irreversible work produce
an incident eventually.
---
## Self-check
```
□ You wrote what the reviewer checks, with the reason
□ "Only a person" came down to half or less
□ Every gate says what happens on failure
□ You actually answered the time-to-undo question
```
If the second failed, go back to step 2 and split further. **A lot of "only a
person" does not mean validation is hard — it means you have not split it yet.**
---
## Check yourself
**1. What do you do when "only a person" is more than half the rows?**
Answer
**Split the rows further.** "Is the document right" needs a person, but "does the
amount match the table" inside it does not. Left whole, all of it stays with the
human.
**2. What happens if a gate does not say what failure does?**
Answer
**It becomes a log, not a gate.** If failing changes nothing, nobody looks at it,
and you end up with checks that run and no control.
**3. What sets the thickness of a gate?**
Answer
**The cost of undoing.** If it can be undone in minutes, loosen the gates and ship
faster. If it cannot be undone, a human gate is mandatory.
---
Pass validation and it ships → [Process 4 — immediate delivery](/guide/ha-phase4-delivery)