Manj Chenna

Essay · Design

How to build oversight that actually holds

Oversight that holds is not a warning label or a person cc'd on the outcome. It is a handful of design choices, each boring on its own, that together keep a human genuinely in command when it counts.

scroll to read
Manj Chenna · Founder, Sanctity · Amsterdam · June 24, 2026

Most oversight fails not because anyone meant it to, but because it was never designed, only declared. A line in a policy is not a mechanism. Oversight that survives contact with a real deployment is built from concrete patterns, and the patterns are unglamorous on purpose. Here are the ones that carry the weight.

An override that changes theoutcomeNot a log entry. A control wiredto the answer.A named person, not a queueSomebody who can be asked aboutit afterwards.Escalation the agent cannotgameTriggered by the decision, not byconfidence.A record a stranger can readWritten for the person who wasnot in the room.A stop with a test dateExercised on an ordinaryTuesday, not discovered on a badone.A number somebody reportsBecause an unmeasured controlquietly stops working.EACH ONE IS BORING. TOGETHER THEY ARE THE WHOLE THING.
An override that changes the outcomeNot a log entry. A control wired to the answer.A named person, not a queueSomebody who can be asked about it afterwards.Escalation the agent cannot gameTriggered by the decision, not by confidence.A record a stranger can readWritten for the person who was not in the room.A stop with a test dateExercised on an ordinary Tuesday, not discovered on a badone.A number somebody reportsBecause an unmeasured control quietly stops working.EACH ONE IS BORING. TOGETHER THEY ARE THE WHOLE THING.
Most oversight fails not because anyone meant it to, but because it was never designed, only declared. A line in a policy is not a mechanism.

The patterns that hold

  1. A real override. The human can change or reverse the outcome, the system honors it, and you can measure how often that actually happens. A "no" the system can ignore is decoration.
  2. A named accountable human. For decisions that need oversight, a specific person is answerable, not a rota and not a department. Accountability with no name attached evaporates exactly when you need it.
  3. Honest escalation. The agent stops and asks on the calls that genuinely need a person, and does not bury them under a flood of trivial ones. The right things reach a human, in time.
  4. An audit trail two readers can use. A record that a regulator and a wronged customer can both follow, not a log only the vendor can parse.
  5. A stop that works. A way to halt the system that someone has actually tested, before the day they need it.

Why these and not more process

You could add reviewers, sign-offs, and committees and still have no oversight, because more process is not more command. These patterns share a property: each produces evidence. An override leaves a rate. A named human leaves a record. An escalation leaves a decision. Process that produces no evidence cannot be audited, and oversight you cannot audit is the kind that turns out, under pressure, to have been theater.

Build for the bad day

The test of oversight is not the demo, it is the incident. Build each pattern as if you will have to explain it after something went wrong, because eventually you will. The systems that hold are the ones designed by people who pictured that day in advance and made sure a human could have changed it.

Read on

See the Meaningful Override Rate for the override pattern's measure, the accountable human for the named-human pattern, and escalation design.