Every approval gate buys a check by spending velocity. Safety and velocity are one dial, read from two ends.
On December 22, 2018, the government of the most powerful nation on earth stopped working. Not because of an attack, a disaster, or a collapse, but because its own branches, exactly as the Constitution designed them to, blocked each other. The president wanted funding for a border wall; the Congress would not appropriate it; neither could compel the other; and so the United States federal government simply shut down. It stayed shut for 35 days, the longest shutdown in modern American history, until January 25, 2019. Roughly 800,000 federal workers went unpaid. Air traffic controllers worked without checks. National parks filled with garbage. The machinery of a superpower sat idle over a single appropriations dispute.
Here is the thing to sit with before you call it dysfunction: that was the system working as designed. The American framers, terrified of concentrated power, deliberately built a government in which no single branch can act alone: the president, the House, and the Senate each hold a veto over the others. That mutual blocking is the celebrated "separation of powers," the very mechanism that prevents any one actor from seizing control and becoming a tyrant. And it is the identical mechanism that produced the 35-day shutdown. The check that protects you from concentrated power and the gridlock that paralyzes you are not opposites you can engineer away from each other. They are one dial, read from two ends. Turn it toward safety and you turn it toward paralysis, because they are the same turn.
Every approval gate, sign-off, and review in your engineering organization is a position on that exact dial, and you almost certainly set it without realizing you were writing a constitution.
Political science has a precise name for the dial. In 2002, the political scientist George Tsebelis published Veto Players: How Political Institutions Work, and gave us the cleanest formal statement of the trade-off. A veto player is any actor whose agreement is required to change the status quo. Tsebelis's central finding: as the number of veto players grows, and as their positions diverge, policy stability increases and the capacity for change diminishes. More veto players means it is harder to pass a bad law and harder to pass any law. The same parameter governs both. You cannot tune one without tuning the other.
This is why the world's democracies cluster into two families that make opposite bets. Presidential systems, the United States, Brazil, have strong separation of powers: independent branches, each a veto player, deliberately set against each other. They are robust against the concentration of power (it's genuinely hard for an American president to become a dictator) and chronically prone to gridlock (it's genuinely hard for an American president to get anything done). Parliamentary systems, the United Kingdom, Germany, instead fuse the executive and the legislature: the government is drawn from the majority in parliament, so the executive and legislative "branches" are essentially the same people. This removes veto points. A parliamentary government with a majority can act decisively, pass a budget in an afternoon, at the cost of weaker checks: there's simply no separate branch standing in the way.
In 1990, Juan Linz made the danger of the presidential bet famous in an essay called "The Perils of Presidentialism," now cited well over a thousand times. His warning was that the separation between an independently-elected president and an independently-elected legislature creates a dual-legitimacy deadlock: both can claim to speak for the people, neither can force the other, and when they disagree the result is "immobilism, gridlock," and sometimes the temptation toward extraconstitutional escape. The shutdown is Linz's thesis rendered in unpaid paychecks.
The iron point underneath all of it: you cannot maximize both safety and velocity. They are the same dial read from opposite ends. Anyone who tells you a process change will make you both safer and faster is, at best, removing pure waste (real, and worth doing), but at the margin, past the waste, the trade is unavoidable. Every check you add is a veto player, and every veto player is a brake.
Now look at how a change ships in your organization. Before that code reaches production, whose independent yes is required? The security sign-off. The architecture review. The second on-call engineer's approval. The change-advisory board's blessing. The team lead's stamp. The compliance checkbox. Each of those is a veto player, an actor who can block the change, and each one you added was a constitutional choice on Tsebelis's spectrum, moving your organization toward the presidential end: more separation, more checks, more protection against a bad change, and more gridlock against every change.
The trouble is that almost no one experiences it as a constitutional choice. You don't sit down and say, "we are hereby adopting a strong-separation-of-powers regime for deployments, accepting gridlock as the price of safety." You add one sign-off after a bad incident. It feels obviously correct, that incident was real, and a check would have caught it. So you add another after the next incident. And a board for the auditors. And a reviewer for the database changes. Each addition is individually defensible and locally rational. But each is also, whether you name it or not, a veto player, a brake on the whole system, and the dial only turns one way under accretion: toward gridlock. There is no setting of the approval process that gives you both maximum safety and maximum velocity. There is only a position on the trade-off, and you are at one whether you chose it or it chose you.
The beautiful thing about this domain, better than political science, which can't run controlled experiments on nations, is that engineering measured the trade-off empirically, and the result is sharper than the theory predicted.
The DORA research program (Nicole Forsgren, Gene Kim, and Jez Humble, synthesized in their book Accelerate) studied change-approval processes across thousands of organizations. They specifically tested the heavyweight, external veto player, the change-advisory board (CAB), the formal committee that ITIL change-management prescribes to review and approve changes. And what they found should be tattooed on the wall of every operations leader who ever added a sign-off "to be safe": external change approval was negatively correlated with speed (lead time, deployment frequency, time-to-restore all got worse) and had no correlation with change-fail rate at all. The CAB did not make changes safer. It just made them slower.
Read that again, because it's the rare case where the data is unambiguous: the veto player cost velocity and bought nothing measurable in safety. It was, in the precise sense, pure gridlock, the costs of separation of powers with none of the protection. The DORA recommendation is the parliamentary move: replace the external approval branch with a fused check, lightweight peer review (pair programming, intra-team code review) plus an automated deployment pipeline that detects and rejects bad changes. Build the check into the body that acts, rather than standing up a separate branch to veto it. For ordinary, reversible changes, the fused parliamentary check beats the separated presidential one, faster and, it turns out, no less safe, because the heavyweight separation wasn't buying safety in the first place.
That doesn't repeal Tsebelis, it refines him. Veto players that are well-placed (a real check on a real risk) buy real protection. Veto players that are accreted (a sign-off added by reflex, on a change that's reversible anyway) buy gridlock and call it diligence.
Which is exactly the failure mode to fear, and political science names it precisely: veto players accumulated without intent. No constitutional convention ever convenes to decide "we want nine sign-offs on every change and permanent gridlock." Instead the veto points accrete, one per incident, one per audit, one per anxious VP, each defensible in isolation, until a one-line configuration fix takes three weeks to ship because it must pass security, architecture, the CAB, two on-call engineers, a team lead, and a compliance review, and no one ever decided that this much safety was worth this much paralysis. The organization is now running a strong-separation-of-powers constitution. It is in permanent gridlock. And it backed into that constitution one reasonable-seeming sign-off at a time, getting all the costs of separation of powers without ever consciously choosing them, which is the worst of every world, because an unchosen constitution can't be defended or reformed; it's just there, ossifying, while everyone complains about "process" as if it were weather.
The shutdown, at least, was the product of a constitution someone designed on purpose, with eyes open to the trade-off. The nine-sign-off deploy pipeline usually isn't. It's gridlock no one chose, doing damage no one's measuring, in the name of safety no one verified.
The prescription falls right out of the theory: choose your number of veto players deliberately, and by domain, keyed to stakes and reversibility. You are running not one constitution but many, one per kind of change, and they should not all be the same.
For a system that touches money, safety, or anything irreversible, be presidential. Adopt strong separation: multiple independent checks, real veto players, and accept the gridlock as the conscious price of not concentrating the power to cause catastrophe. When a mistake is unrecoverable, wiring funds, deleting customer data, a production database migration with no rollback, slow and checked is correct. You want the two-key, two-person, separated-veto regime on the nuclear launch; the gridlock is the feature. Pay for it on purpose.
For a low-stakes, easily reversible system, be parliamentary. Fuse the check into the team, keep the veto players few, and accept the weaker separation as the conscious price of velocity. A reversible mistake is cheap, you roll it back in minutes, so the expensive thing isn't the occasional bad change; the expensive thing is the gridlock. Here the DORA answer is right: peer review plus a pipeline, not a board. And since most changes in most systems are reversible and low-stakes, the default should lean parliamentary, with presidential separation reserved for the genuinely catastrophic and irreversible, the opposite of how most orgs drift, which is to apply the heavyweight regime to everything because it was easier to add the gate than to ask which changes deserved it.
The skill is matching the constitution to the consequence: maximum separation where a mistake is permanent, maximum fusion where a mistake is cheap, and, above all, a decision, not an accretion.
Audit your veto players. Literally count them: for a typical change in each of your systems, how many independent yeses are required to ship? Write the number down; it's usually higher than anyone guesses. Then, for each veto player, ask two questions. First: did we choose this, or did it accrete? Second: does the stakes-and-reversibility of this change justify the gridlock this gate buys?
Then act on the answers. On the reversible, low-stakes changes, which is most of them, remove the accreted veto players and replace them with a fused check (peer review plus a pipeline); the DORA data says you will lose no safety and gain real speed, because those gates were buying gridlock, not protection. On the irreversible, catastrophic changes, keep and strengthen the separation, and say out loud that you are choosing the slowness on purpose, so no one mistakes it for waste and tears it down.
You cannot escape the dial. Every approval gate genuinely does buy a check by spending velocity; there is no free safety and no free speed, only a position you occupy on Tsebelis's spectrum. But you can stop letting that position set itself one anxious sign-off at a time. The framers of every durable constitution did the one thing the gridlocked, over-governed engineering org never does: they chose their veto players, deliberately, knowing the price. Write your constitution on purpose, and read it, occasionally, to make sure it's still the one you meant to adopt.
Don't put a human veto on every agent action. Build the check into the act.
An approval gate on an agent's every move is a veto player, and DORA's finding holds: the heavyweight external check costs velocity and, for reversible work, buys no safety you can measure. The fused alternative is to let the agent act and verify what it did, a check that travels with the action instead of gating it. Chain of Consciousness is that check: a tamper-evident record of an agent's reasoning, tools, and actions that you can audit continuously, so you get the protection without the gridlock of a sign-off on every call, and you can reserve the slow, separated, human-veto regime for the irreversible, catastrophic changes that genuinely deserve it.
See Hosted Chain of Consciousness · verify an action chain
pip install chain-of-consciousness · npm install chain-of-consciousness