Friction You Curse Is Often a Guardrail You Need

Category: Why This Was Never an Accident The step you curse every day is often the one doing nothing until the day it does everything.

Every outbound payment over a threshold needed a second person to approve it. It was a real nuisance. The second approver was often in a meeting, or off that day, and the payment would sit. The team complained about it constantly. In a year of running, the second check had never once stopped a payment. Every one it reviewed was correct, approved on the second glance, slightly later than it needed to be.

When the process was reviewed for efficiency, the second approval was an obvious target. It cost time on every payment and had never caught anything. The numbers were clean. The team was in favour. The step was removed.

For nine months, payments went out faster and nobody missed the check. Then someone, late on a Friday, fat-fingered an account number and approved a five-figure payment to the wrong place. There was no second person to glance at it. It went.

The check that had “never caught anything” had, it turned out, been doing exactly one job the whole time. Being there on the day someone made the one mistake.

The Principle

Some friction is genuine waste and should go. But a stubborn fraction of it is a brake that earns its keep only on the rare day you would otherwise have driven off the cliff, and you cannot evaluate a guardrail by how it feels on an ordinary day, because guardrails do nothing on ordinary days. That is what they are for.

Friction comes in two kinds that feel identical from the inside. The first is residue: a genuine waste, a step that protects nothing, left over from a problem that no longer exists. That kind should go, and saying so plainly is what protects the credibility of the other kind. The second is guardrail: a low-frequency, high-consequence brake that earns its keep rarely but completely. The confirmation prompt. The second pair of eyes. The deliberate pause. The approval that introduces a beat of delay on purpose, because the thing being approved is hard to undo.

The trouble is an accounting trouble. The cost of a guardrail is paid every time, and the benefit is collected almost never. On any given ordinary day, the honest tally is negative. The step cost a few seconds and gave nothing back. And an ordinary day is the only kind of day you ever have, right up until the rare one. So the running total looks permanently in the red, and “it has never caught anything” starts to sound like proof the step is useless. It is not. It is a description of a guardrail doing precisely what a guardrail does, which is nothing visible, for a long time, until it does everything at once.

Why It Pays Off

Keeping the right friction is high-leverage work, even though the leverage is rare. Three reasons the payoff is real.

The first is that the consequence it guards against is severe and concentrated. The brake costs seconds across thousands of safe transactions in order to prevent one catastrophic one. The expected value of that trade can be strongly positive even when the probability is tiny, because the downside it fences off is so large. The second-approver cost the team a few minutes on every payment for a year. The single mistake it would have caught was a five-figure transfer to the wrong place, which is not a few minutes of anyone’s time to recover. You do not judge a bet by how often it pays. You judge it by the size of the payout against the size of the stake, and a small certain cost against a rare enormous loss is often a bet worth making.

The second is that the mistakes it catches are the ones humans reliably make under load. The fat-fingered number. The wrong recipient. The irreversible action taken while distracted at the end of a long day. These are not exotic failures. They are the predictable ones, the errors a tired person makes on a Friday, and a second checkpoint is built precisely to catch the class of mistake that the first person was always going to make eventually. The guardrail is not insurance against bad luck. It is insurance against ordinary human error, which is far more reliable to bet on.

The third is that a guardrail requires understanding to evaluate, not just measurement. You cannot judge it on its catch-rate alone. A guardrail that has caught nothing may be useless residue, or it may be a brake on a cliff you have simply never driven toward yet. Telling those two apart needs judgement about consequence, not a tally of frequency. The catch-rate looks like a verdict and is actually only half the evidence. The other half is the question nobody on the efficiency review asked: what does this catch, and how bad is the thing it catches?

Keeping the right brake is not timidity. It is a clear-eyed bet on a rare and ruinous tail.

The Benefit

The payoff is real, occasional, and almost entirely unbanked in how the team feels about the step day to day.

The first benefit is a cap on the worst case. The guardrail does not make ordinary days better. It makes the worst day survivable, which is a different and more valuable thing. The second-approver did nothing for the team’s good days. It existed entirely for the one bad day, and on that day it was the difference between a near-miss and a loss. A step that makes your worst day survivable is worth more than a step that makes your average day marginally nicer, even though the average day is the one you experience.

The second benefit is a forced moment of attention at the point of danger. The friction is not only a check. It is a deliberate pause that interrupts autopilot exactly where autopilot is most expensive. The “are you sure?” makes you, briefly, sure. The second glance at the account number is a second chance for a tired person to see what they could not see the first time. The cost of the pause is the whole point of the pause. It puts a beat of conscious attention into the one place a slip would be unrecoverable.

The third benefit is resilience the team never has to think about. A good guardrail lets people move fast on every ordinary action precisely because the rare ruinous one is fenced off. The brake is what makes the speed safe. People could approve payments quickly all year because the catastrophic version was held back by the second check. Remove the brake and the speed is still there, but so is the cliff, and now nothing stands between them.

The deeper benefit is also why the step gets no thanks. The guardrail’s value shows up as the absence of a category of disaster, which is invisible and therefore unfelt. The people who keep the right brake in place earn no credit, because there is no incident to point at, no thank-you to give. The team’s lived experience is only the cost. The asymmetry is the whole story. The friction’s cost is small, certain, and constant. Its benefit is large, uncertain, and rare. That is exactly why the case to remove it always sounds stronger than the case to keep it, and why the removal so often sails through on a Tuesday.

How It Shows Up

• The approval step everyone groans about that has, this year, approved everything put in front of it, and is therefore first on the chopping block at the next efficiency review.
• The “are you sure?” prompt people click through on reflex, that exists for the one time in a thousand they should not have.
• The second signature treated as a bottleneck, defended only by a vague sense that it “feels safer,” because nobody can produce the disaster it prevented.
• The slightly-too-slow process that introduces a pause on purpose, mistaken for an accident of bad design.
• The efficiency review that removes a control with a clean record, true numbers, willing team, no recent incidents, and books the saved time as a win, with the rare-day cost nowhere on the page.

How To Cultivate It

• Judge a guardrail by its worst-case, not its average day. Ask what this catches, and how bad the thing it catches is, before asking how often it fires. A low catch-rate on a catastrophic failure is a feature of a working brake, not evidence of a useless one.
• Before removing friction, write down what it was protecting against. If the team cannot name the failure mode, that is a reason to investigate, not a licence to delete. A guardrail nobody understands is a question, not an answer.
• Separate residue from guardrail explicitly. Not all friction is sacred, and saying so out loud protects the credibility of the friction that is. Be ruthless about removing steps that protect nothing. Be deliberate about keeping the few that fence off a cliff. The discipline the whole thing turns on is telling one from the other.
• Treat “it’s never caught anything” as ambiguous evidence. It means either the brake is useless or it has been quietly holding a line you never crossed. Resolve the ambiguity by reasoning about consequence, not by reading the catch-rate as a verdict.
• When you remove a guardrail, do it as a reversible experiment with a watch on the tail. Do not book the saved time as a permanent win on day one. Assume the rare event has not happened yet rather than that it cannot, and keep the option to put the brake back before it does.

What Good Looks Like

The mark of success is, deliberately, that the worst day never arrives. Success here is a category of disaster that simply does not happen, behind a brake the team has learned to keep without resenting it into the bin. Friction that protects nothing is gone. Friction that fences off a ruinous tail stays, and the team knows which is which and why. The second check is defended not by “it feels safer” but by a named failure mode it exists to catch. And the rare day, when it comes, is a near-miss instead of a catastrophe. A story about the guardrail doing its one job, rather than an incident report about the day someone removed it.

The point worth holding is the inversion the whole chapter turns on. The friction that has done nothing for a year is not necessarily dead weight. It may be the quiet reason the year had no disaster in it. The discipline is to keep it not because it feels good, which it never will, but because you have understood what it is standing between you and.

A Reflective Question

Which control does your team most want to remove because it “never catches anything,” and have you worked out whether that means it is useless, or that it is the only reason you have never had the disaster it was built to catch?