A 30-to-45-second timeout change, four approvals, no merge: the cost of a two-person gate

Four approvals were not four approvals. CODEOWNERS does not count reviewers, it matches paths to named accounts, so a pull request can collect any number of passes and stay blocked until one specific person clicks ^[5]. With two names on most infrastructure paths, one lead in a meeting removes half the approval capacity and two leads in the same meeting removes all of it ^[20]. The billing-export change had the reviewers it needed by any reasonable reading and still needed a fifth, particular signature ^[21].

Now the ledger the rule actually produced. Thirty-one pull requests each waiting more than two business hours is a floor of 62 business hours of blocked work in a ten-weekday window ^[7][17]. The incident that motivated the rule was an S3 bucket policy left too open for 47 minutes ^[6]. That is a ratio of roughly 79 to 1 ^[18]. Wait time and exposure time are not the same unit, and nobody should pretend a blocked dependency bump is as bad as an open bucket. But the rule was sold internally as a brake ^[6], and the only quantity it demonstrably generated was hours of other people's stalled work.

The composition of that queue is thinner than it looks. Nine dependency bumps, six fixes to alerts that were already paging, and the timeout account for 16 of the 31 ^[8][19]. The other 15 are unlabelled, which means the documented sample is the harmless end and the real distribution is unknown even to the team that ran the gate.

One detail in the correction says more about review quality than the ownership map does. The team pinned terraform 1.8.5 in .tool-versions on 2026-08-18 because tool drift had been supplying fake disagreement in plan output ^[14]. Some fraction of the queue's dwell time was therefore spent arguing about diffs generated by different binaries, not about consequences. A one-line version pin plausibly bought more scrutiny than a named approver did, and it cost nobody a wait.

What replaced the broad rule is narrow: service operators own their own paths, and lead review survives for identity, network boundaries, account creation and production deletion paths ^[12], with a risk:high label carrying one lead approval instead of treating every YAML file as equivalent ^[13]. The team is explicit that this only held because service owners already had production access and knew their rollback paths, and that it is untested above 40 engineers or in a company with three separate compliance teams ^[15]. That is the honest boundary on the whole story: this is a fix for 26 services and four node pools ^[16], not a policy.

The failure underneath is measurement. A broad path rule feels like governance because it produces approvals, and an approval count tells you nothing about whether scrutiny was added ^[11]. The team ran that rule for six months and needed three hours of digging to find out what it had done ^[4].