Risk-Scored Routing Cuts Human Review to High-Signal Queries Only

Three weeks after a text-to-SQL agent went in front of an internal analytics team, someone asked it to "clean up the test rows in the promotions table." The agent interpreted "clean up" as "delete" and "test rows" as anything with an is_test flag or a name containing "test," and generated a DELETE that would have removed 40% of a table backing several live dashboards. The query never ran — a blanket gate blocked all non-SELECT execution pending human approval. But six weeks later that same gate had pushed median approval wait past fifteen minutes, and reviewers were batch-skimming five or six queries at once to keep pace. The oversight mechanism had not failed dramatically; it had quietly inverted, spending reviewer attention on routine queries and leaving none in reserve for the one that actually warranted it. Priyansh Bhardwaj's August 2026 write-up for Towards Data Science dissects exactly this failure mode, and the architecture it proposes sits at the intersection of systems engineering tradeoffs that now rival raw scaling in production impact.

Four Signals That Drive the Router

The solution replaces operation-type gating with a continuous risk score computed before any action reaches a reviewer's screen. Bhardwaj documents four signals derived from retrospective analysis of the first six weeks of approval logs.

Blast radius is computed not from query planner estimates — explicitly discarded after proving unreliable on skewed columns and correlated predicates — but from a bounded real count: count(*) executed against the actual WHERE clause, capped at 50,000 rows, then stopped. This gives a deterministic, cost-bounded number rather than a planner guess.

Table sensitivity is a static allowlist assigning floor risk scores to tables touching billing, authentication, or regulated data. The author treats this as the one component that must not be learned, because some tables should never be eligible for auto-approval regardless of what the query looks like.

Semantic novelty is measured against an embedding index of previously approved query intents. A request that sits close to fifty prior approved queries carries lower routing risk than a semantically novel one — not because novelty is inherently dangerous, but because it is where agent intent-parsing is most likely to have diverged from user intent.

Resample disagreement replaces token-level model confidence, which the team explicitly rejected as poorly calibrated. The same query is regenerated two or three times at slightly elevated temperature; output divergence across those samples is treated as a stronger signal of genuine ambiguity than anything the model self-reports.

The composite score weights those signals at 0.40 for normalised blast radius, 0.25 for table sensitivity floor, 0.20 for novelty, and 0.15 for disagreement, with the constraint that a sensitive-table floor score can never be overridden downward by the other terms.

Routing Architecture and Async Queue Decoupling

The user-facing change matters as much as the routing logic. In the naive implementation, an escalated action caused the agent to go silent — giving users no way to distinguish "pending review" from "system hung." The replacement uses a ticket model: the action is acknowledged immediately, the user receives a message quoting the queue's p90 wait time in minutes, and the approval result is delivered as a notification rather than a blocking response. This does not reduce actual review duration; it stops review duration from presenting as system failure.

Where Human Review Retains Real Value

Post-deployment log analysis produced a clear answer to where human reviewers were catching something versus rubber-stamping. Reviewers added value on requests where the agent's interpretation of intent was plausible but wrong — specifically, where ambiguity lived in the user's phrasing rather than in the SQL syntax. The canonical example remains the original incident: "clean up the test rows" is something a human reviewer resolves instantly by evaluating intent, not by parsing a WHERE clause. Reviewers added essentially no value on mechanically correct, well-scoped queries generated in response to unambiguous instructions — a DELETE by primary key following an explicit, context-rich conversation turn.

Bhardwaj flags two unresolved operational concerns. The embedding index of prior approved intents requires active pruning; stale patterns from discontinued product features make the novelty signal progressively less accurate. The router weights have already shifted twice since initial tuning, and the team has no principled answer for how frequently retuning should occur as query patterns drift. Automated feedback — closing the loop by feeding approval and rejection outcomes back into weight updates — is identified as the obvious next step and the one the team has deliberately declined, on the grounds that a safety-relevant threshold that reduces its own caution autonomously, based on a recent run of uneventful approvals, is precisely the condition under which the next incident tends to occur. This tension between autonomy defaults and meaningful safety controls is not unique to this system.

The broader signal is architectural: teams making production agents work at scale are not waiting for better models, they are building better routing. Confidence-gated escalation, async queue decoupling, and static sensitivity floors are engineering choices that compound — and the gap between teams that have made them and teams still running blanket approval gates is already measurable in analyst hours and incident rates.