A logistics company's agent can reschedule deliveries, issue refunds up to a configured limit, and change a customer's payout bank account. Leadership wants human oversight but has only a small operations team. Which review design is most appropriate?

Answer: D — Gate payout-account changes on enforced approval, route refunds by rule, and sample reschedules

Review should be tiered by impact and reversibility and sized to reviewer capacity. Bank-detail changes are a classic fraud vector and hard to reverse, so they get an enforced gate; refunds follow code-enforced limits with exceptions routed to people; low-risk reschedules are sampled. (a) overwhelms a small team and invites rubber-stamping. (b) leaves the irreversible action ungated. (c) asks the model to enforce a hard control, and customer confirmation doesn't verify against fraud.