AI Made the Access Queue Louder. Approval Is Still the Work.

UNC sent 265 of 319 clinical-data requests through an administrative lane. Of those, 72.5% cleared within 14 days. Only 16.9% required full committee review, and 35.2% of that smaller group took at least 61 days. The mechanism combined one intake, a structured request, trained brokers, alignment to existing approval, and escalation for higher-risk or controversial uses. NCATS uses the same control family at national scale and states that its bounded N3C process usually takes 15 business days from request to workspace.

The UK Open Banking order required nine large banks to fund a common implementation entity, use shared standards, and enable customer-authorized access. Six had completed the roadmap by January 2023, while three had not. A remedy expected to finish in January 2018 remained incomplete more than five years later and cost more than £150 million against an initial estimate below £20 million. Regulation changed the formal entitlement, but it did not make implementation prompt, cheap, or complete.

FedRAMP standardized security assessment, authorization, and monitoring so agencies could reuse evidence. Twenty-one surveyed agencies said leveraging Joint Authorization Board authorizations reduced time and effort, although GAO did not measure marginal approval cost. N3C signs one institutional agreement for all users, then makes a narrower project decision inside a controlled enclave. Both mechanisms centralize proof while preserving a named residual authorizer.

Zanzibar showed authorization enforcement below 10 milliseconds p95 at global scale. DUOS encoded 118 of 123 genomic data-use limits and all 52 proposals, and 51 received a head-to-head comparison against committee review with full concordance. Later committee research still found low prioritization, concern about over-automation, and uncertainty about efficiency. The technology can execute a decision boundary that the organization has delegated; it cannot create that delegation by itself.

The CASES Act required electronic access and consent forms, yet only one of 17 reviewed agencies had fully implemented the requirement by September 2022. In disaster lending, SBA and IRS wanted near-real-time data sharing, but SBA lacked statutory authority for direct consent-free receipt. Mandates may not produce timely access when legal authority, technical capacity, accountable ownership, or an executable control process remains unresolved.

Report request-to-decision and decision-to-provision separately, including median and 90th percentile by data class, owner, exception type, and review lane.

Settle the legal basis first, as preconditions rather than fields: lawful basis for the intended use, purpose-limitation test, minimum-necessary determination, any cross-border transfer mechanism, named processors and their contract terms, and the vendor's training-use and retention position. Then name the operating attributes: purpose, fields, risk tier, eligible roles, controls, retention, expiry, evidence owner, and exception lane, with an explicit deny path alongside the approve path.

Use completeness checks and existing policy alignment for routine cases. Escalate changed purpose, sensitivity, sharing, population, or external exposure.

Carry forward umbrella agreements, approved data tiers, enclave controls, identity proof, automatic expiry, and standard evidence packages.

Name the accountable executive, control owner, service objective, incident threshold, exception budget, and authority to change policy.

Review safe time-to-entitlement, request quality, expiry hygiene, and incidents per 1,000 grants together, as measures of the system. Look for speed without a worse control outcome. Keep these off the personal scorecards of independent control roles: their objectives and compensation are governed by rules a transformation office does not set, so that change belongs to a board committee. Measure the queue, not the officer.