Approval friction: why governance slows AI pilots to a stop

Governance gets a bad name because most people only meet its worst version: a wall of approvals where nobody remembers why each gate exists, and the AI pilot dies waiting in line. The reaction to that is usually to swing the other way and strip governance out entirely. Both moves miss the real skill, which is telling the difference between friction that protects someone and friction that only protects a job title.

Getting that wrong is expensive on both ends. Shadow-AI breaches, the kind that happen when people route around slow approvals, average $4.63 million. Too little friction is a fortune. Too much is a pilot that never ships. The work is finding the line.

The officer who ran a large trial with a small team

A former Army officer who now runs a clinical-stage biotech described leading a small team executing a large global clinical trial. In that world the stakes are patient safety, so some friction is not negotiable, you do not skip a control because it is slow. But he was blunt about the failure mode that actually kills teams. Experts protect their turf. Each function guards its own approval, and problems that should be solved together get thrown over walls instead. His job was to break those silos so specialists solved problems in the same room, rather than trading sign-offs across them.

His instinct, shaped by leading soldiers in high-stakes environments, was to listen first, set clear principles, and then act with calm resolve. Notice what that is not. It is not “add a gate for every risk.” It is “know which principles are load-bearing, make them explicit, and let people move fast inside them.” The friction he kept was the friction that protected patients. The friction he removed was the friction that only protected turf.

Most AI approval friction is turf, not safety

Here is the pattern in AI pilots. A feature needs to touch a dataset, and the approval to do so sits with a team that gains nothing by saying yes and carries all the blame for saying yes wrong. So the request sits. Nobody is protecting the customer. Everybody is protecting themselves. That is turf friction, and it is the kind that quietly ends pilots.

Real safety friction looks different. It is specific, it maps to an actual harm, and the person enforcing it can tell you what goes wrong if it is skipped. If nobody can name the harm a gate prevents, it is not governance, it is a habit wearing governance as a costume.

Keeping the friction that earns its place

You can move fast and still be safe if you are honest about which gates are which:

Ask what harm each approval prevents. If no one can name it, the gate is a candidate for deletion.
Put the deciders in one room. Silos turn one conversation into six sign-offs.
Pre-approve the low-risk path. Reserve human review for the decisions that actually carry risk.
Make the principles explicit. People move fast when they know the lines, and freeze when they have to guess.

How we approach it at Density Labs

In the AI Readiness Assessment, our $2,500 front door, we look at where a pilot is actually stuck, and a surprising amount of the time it is not engineering, it is approval friction with no owner. We separate the gates that protect data and people from the ones that only protect a process, and we design a path that keeps the first and drops the second. A governance plan built this way runs in about 90 days and does not slow the projects that were already approved to move.

The officer did not run a loose ship. He ran a tight one where every rule that stayed could explain itself. Do that with your pilot and governance stops being the thing that kills it.

Keep the gate that names the harm. Delete the one that only names a department.