Most bad network changes were approved by humans reading diffs. Split policy from evidence, tier by blast radius, and make rollback a precondition.