REAVLEY, Circuit Judge:

The families of Navy divers killed in a Navy submarine diving chamber brought this products liability action under the Death On The High Seas Act, 46 U.S.C. App. § 761 et seq., and the federal Admiralty law, 28 U.S.C. § 1333, against General Dynamics Corporation, the designer of the chamber. General Dynamics also filed a cross-claim against the United States claiming that, in the event it was found liable to the plaintiffs, the United States would be liable to General Dynamics under a contractual indemnification clause. Trial was to the court, which held that General Dynamics was liable for the deaths of the divers and that the United States was not liable to General Dynamics under the indemnification clause. Trevino v. General Dynamics Corp., 626 F. Supp. 1330 (E.D. Tex. 1986). We affirm the judgment for the families of the divers against General Dynamics and vacate, for lack of jurisdiction, that part of the judgment favoring the United States on contractual indemnity.

I. Factual Background

On the night of January 16, 1982, five United States Navy divers died in an accident aboard the submarine U.S.S. GRAYBACK. The ventilation valve, which allowed air to enter the flooded diving chamber, was not fully open; and as the divers drained the water, a vacuum formed in the chamber.

The U.S.S. GRAYBACK was designed and constructed in the late 1950s as a missile-carrying submarine. It was equipped with two large cylindrical pressure chambers on its forward deck, which were used as storage hangars for the missiles. In the late 1960s the GRAYBACK was converted to a personnel-carrying submarine capable of dispatching divers underwater. One portion of that conversion was the installation of a diver lock-in/lock-out system in the cylindrical pressure chambers. The Navy established the basic design concept for the modifications to the GRAYBACK in a 339-page circular of requirements ("COR") describing the design concepts, including two pages describing the design of the diving hangar and a one-page diagram of the flood and drain system, and selected Mare Island Naval Shipyard ("MINS") as the site for the design and conversion work.

In 1966 and 1967 the Navy contracted with General Dynamics Corporation Electric Boat Division to do the design work on the diving hangar. The contracts required General Dynamics to produce working drawings of the hangar and the lock-in/lock-out system and to assume full responsibility for all necessary technical research, to review its work product to assure compliance with the COR, and to conduct all quality assurance, including inspection of the end product, before issue to the Navy. General Dynamics supplied 37 employees, who worked on-site at MINS and produced 71 pages of detailed working drawings. Each of the drawings was signed by a government employee in a box marked "approved." After General Dynamics completed the drawings, their employees left MINS, and the Navy performed all the manufacturing and conversion work on the GRAYBACK.

The design concept, as stated in the COR, called for a "control bubble," a plexiglass enclosure that would be lighted and filled with air while the diving hangar was flooded, from which a diver could operate all the controls necessary to drain the diving hangar. General Dynamics's design, however, placed the hand wheel control for the ventilation valve adjacent to, but not controllable from, the control bubble. General Dynamics's design did not include a lighted position indicator on the ventilation valve control, a remote valve position indicator, vacuum gauges, safety interlocks, or any other type of warning or safety device to prevent a vacuum or to notify the divers or the crew inside the submarine ("the dry side") of the presence or possibility of a vacuum. The Navy operated the submarine for 13 years without mishap, although Navy personnel noted on at least four occasions that the ventilation valve control was difficult to turn. The Navy never performed nor required a formal design/safety review of the GRAYBACK's diving system prior to the accident.

Following the accident, the Navy conducted an investigation and concluded that the accident was caused by "a combination of design deficiency, material defect, unsound operating procedures, and personnel error." Specifically, the Navy found the following four design deficiencies: that there was no safety interlock mechanism to prevent the opening of the hangar drain valve when the main vent valve was not fully opened; that the only valve position indicator on the main vent valve was a metal tab that was underwater and could not be seen when draining the hangar; that there was no remote position indicator that could be seen from the dry side of the hangar; and that the general design of the hangar made proper maintenance of the main vent valve extremely difficult, "if not impossible." Trevino v. General Dynamics Corp., 626 F. Supp. at 1332-33. The district court found that both the Navy and General Dynamics were negligent and that the design was dangerously defective. General Dynamics was negligent in failing (1) to provide for a safety interlock device, (2) to provide for a valve position indicator that is visible when draining the hangar, (3) to provide for a remote position indicator that could be seen from the dry side, (4) to design the valve so that proper maintenance was possible, (5) to adhere to the Navy's COR requiring that the vent valve be controllable from the control bubble, (6) to warn the Navy about the dangers associated with the design's potential to create a partial vacuum, and (7) to warn or instruct the Navy concerning the failure to provide for basic safety and warning devices. The Navy was negligent in failing (1) to provide for basic safety features in its COR, (2) to perform sufficient operational testing, (3) to conduct a formal design review of the system, and (4) to properly lubricate and maintain the shaft to the main hangar vent valve. The court attributed 80% of the fault to General Dynamics and 20% of the fault to the Navy. Although many aspects of the faulty design and the improper maintenance of the system contributed to the accident, the fundamental design defect was that the design of the hangar made it impossible for the diver who was draining the system to know whether the vent valve was fully open and that there was no backup system of any sort to prevent a vacuum or to warn the diver or the crew if the diver did begin to drain the hangar while the vent valve was partially closed. None of the parties on appeal question the correctness of the finding that the design was defective.

The parties do dispute whether General Dynamics, as a government contractor, is responsible for the injuries caused by its defective design. The principal question presented in this case is what are the contours of the government contractor defense recognized by the United States Supreme Court in Boyle v. United Technologies Corp., ___ U.S. ___, 108 S.Ct. 2510, 101 L.Ed.2d 442 (1988).

II. A Government Contractor's Derivative Immunity

Prior to the Boyle decision, this circuit and others had recognized under federal common law a defense that protected government contractors from liability in products liability actions based on injuries to servicemen caused by defectively-designed military equipment. See Bynum v. FMC Corp., 770 F.2d 556, 574 (5th Cir. 1985); see also Tozer v. LTV Corp., 792 F.2d 403, 406 (4th Cir. 1986), cert. denied, ___ U.S. ___, 108 S.Ct. 2897, 101 L.Ed.2d 931 (1988); Shaw v. Grumman Aerospace Corp., 778 F.2d 736, 738 (11th Cir. 1985); In re Air Crash Disaster at Mannheim Germany on Sept. 11, 1982, 769 F.2d 115, 122 (3d Cir. 1985), cert. denied, Schoenborn v. Boeing Co., 474 U.S. 1082, 106 S.Ct. 851, 88 L.Ed.2d 891 (1986); Tillett v. J. I. Case Co., 756 F.2d 591, 597 (7th Cir. 1985); McKay v. Rockwell Int'l Corp., 704 F.2d 444, 451 (9th Cir. 1983), cert. denied, 464 U.S. 1043, 104 S.Ct. 711, 79 L.Ed.2d 175 (1984). This immunity for government contractors was derived from the government's immunity under the Feres-Stencel doctrine. See Bynum, 770 F.2d at 565; see also McKay, 704 F.2d at 449 ("The reasons for applying the government contractor defense to suppliers of military equipment with design defects approved by the government parallel those supporting the Feres-Stencel doctrine."). Bynum established the following elements for the government contractor defense:

To establish the government contractor defense, a military contractor must first demonstrate that the government is immune from liability under the Feres-Stencel doctrine. . . . Second, the military contractor must prove that the government established reasonably precise specifications for the allegedly defective military equipment and that the equipment conformed to those specifications. . . . Finally, it must be shown that the military contractor warned the government about errors in the government specifications or dangers involved in the use of the equipment that were known to the contractor but not to the government.

770 F.2d at 574. The primary purpose behind this formulation of the defense is to prevent the contractor from being held liable when the government is actually at fault but is protected by the Feres-Stencel doctrine. See id. at 565.

A. The Boyle Defense

The Supreme Court in Boyle v. United Technologies Corp., ___ U.S. ___, 108 S.Ct. 2510, 101 L.Ed.2d 442 (1988), recognized the government contractor defense. The Court's opinion began with fundamentals, noting that state tort law is preempted by federal common law in areas of unique federal interests and holding that the procurement of equipment by the United States is such an area. See id. 108 S.Ct. at 2513-15. The scope of the displacement of state law is defined by the elements of the defense that the Court adopted.

Liability for design defects in military equipment cannot be imposed, pursuant to state law, when (1) the United States approved reasonably precise specifications; (2) the equipment conformed to those specifications; and (3) the supplier warned the United States about the dangers in the use of the equipment that were known to the supplier but not to the United States.

Id. at 2518. The Court specifically rejected the Feres-Stencel doctrine as the basis for this defense, and instead grounded the defense in the policies underlying the discretionary function exception of the Federal Tort Claims Act (FTCA), 28 U.S.C. § 1346(b). Id. at 2517.

With the exception of discarding the first Bynum element, the Supreme Court's articulation of the elements of the government contractor defense is virtually identical to the existing Fifth Circuit law. As we noted recently, the Boyle opinion "does not change the law in this and other Circuits, except to reject the ideological basis for contractor immunity based upon the Feres doctrine." McGonigal v. Gearhart Indus., Inc., 851 F.2d 774, 777 (5th Cir. 1988). Yet that change may be significant. The discretionary function exception, 28 U.S.C. § 2680(a), excepts from the FTCA consent to suit "[a]ny claim . . . based upon the exercise or performance or the failure to exercise or perform a discretionary function or duty on the part of a federal agency or an employee of the Government, whether or not the discretion involved be abused." The Supreme Court noted that this statutory provision "demonstrates the potential for, and suggests the outlines of, `significant conflict' between federal interests and state law in the context of government procurement" and held that "the selection of the appropriate design for military equipment to be used by our Armed Forces is assuredly a discretionary function within the meaning of this provision." 108 S.Ct. at 2517. The Supreme Court's rejection of the Feres-Stencel doctrine as the basis for the defense means that the purpose behind the three elements of the defense is not the attainment of the policies identified in Feres and in Bynum, but deference to the discretionary functions of the government.

The district court applied the three elements of the defense almost exactly as stated in Boyle. See 626 F. Supp. at 1334-35. Although government employees signed each page of the working drawings indicating their approval of the design, the district court held that "the level of review here was not sufficient to constitute `approval.'" Id. at 1336. Thus, this case presents the question, unresolved by the Supreme Court, of what constitutes "approval" under the first element of the Boyle defense.

B. "Approval" Under Boyle

Assuming for the moment that the signatures denoting government approval of General Dynamics's designs were made without any sort of review or evaluation of the designs, that they were mere bureaucratic rubber stamps, that they signified at most the government's decision to allow General Dynamics to make all of the important design choices and the government's confidence in General Dynamics's ability to do so, would such "approval" be sufficient to satisfy the first element of the Boyle defense? The majority in Boyle did not define approval, but the dissent clearly feared such a possibility arising from the majority's formulation of the defense: "Respondent is immune from liability so long as it obtained approval of `reasonably precise specifications' — perhaps no more than a rubber stamp from a federal procurement officer who might or might not have noticed or cared about the defects, or even had the expertise to discover them." Boyle, 108 S.Ct. at 2519 (Brennan, J., dissenting). Actually, the sufficiency of the government approval was not an issue in Boyle. The Fourth Circuit had noted that the Navy and the contractor had worked closely together on the design, that there was abundant evidence of back-and-forth discussions and exchange of information between the contractor and the Navy, and that the Navy had reviewed fully and had approved the final design. Boyle v. United Technologies Corp., 792 F.2d 413, 414-15 (4th Cir. 1986), aff'd, ___ U.S. ___, 108 S.Ct. 2510, 101 L.Ed.2d 442 (1988).

We hold that "approval" under the Boyle defense requires more than a rubber stamp. First, the Court's rejection of the Feres-Stencel doctrine in favor of the discretionary function exception as the basis for the defense tells us that the purpose of the defense is to protect the discretionary functions of the government and that, therefore, approval under the defense must constitute a discretionary function. Second, our reading of the case law defining the notion of a "discretionary function" reveals that not all government acts involving some element of choice are discretionary functions, but only those that involve the use of policy judgment. When the government merely accepts, without any substantive review or evaluation, decisions made by a government contractor, then the contractor, not the government, is exercising discretion. A rubber stamp is not a discretionary function; therefore, a rubber stamp is not "approval" under Boyle.

In considering the first element of the Boyle defense in a case like this one, the trier of fact will determine whether the government has exercised or delegated to the contractor discretion over the product design. The government exercises its discretion over the design when it actually chooses a design feature. The government delegates the design discretion when it buys a product designed by a private manufacturer; when it contracts for the design of a product or a feature of a product, leaving the critical design decisions to the private contractor; or when it contracts out the design of a concept generated by the government, requiring only that the final design satisfy minimal or general standards established by the government. If the government delegates the design discretion to the contractor, the exercise of that discretion does not revert to the government by the mere retention of a right of "final approval" of a design nor by the mere "approval" of the design without any substantive review or evaluation of the relevant design features or with a review to determine only that the design complies with the general requirements initially established by the government. The mere signature of a government employee on the "approval line" of a contractor's working drawings, without more, does not establish the government contractor defense. The trier of fact should not evaluate the wisdom or quality of any government decision, but must locate the actual exercise of the discretionary function. If the government contractor exercised the actual discretion over the defective feature of the design, then the contractor will not escape liability via the government contractor defense — the government's rubber stamp on the design drawings notwithstanding.

That Boyle requires more than a rubber stamp is clear from its formulation of the elements of the defense, each of which serve to locate the exercise of discretion in the government. Under the first element the government must approve reasonably precise specifications. The requirement that the specifications be precise means that the discretion over significant details and all critical design choices will be exercised by the government. If the government approved imprecise or general guidelines, then discretion over important design choices would be left to the government contractor. The same is true for the second element, which requires that the equipment conform to the specifications. If the contractor were free to deviate from the government's specifications, then discretion over the design choices would be exercised by the contractor, not by the government. Boyle noted that "[t]he first two of these conditions assure that the suit is within the area where the policy of the `discretionary function' would be frustrated — i.e., they assure that the design feature in question was considered by a Government officer, and not merely by the contractor itself." 108 S.Ct. at 2518. It would be absurd, then, to fashion a rule that allowed liability when the specifications were not sufficiently precise or when the contractor deviated from the specifications while disallowing liability when the federal officer signing the design approval did not review or understand the specifications or care whether the contractor deviated from them. As we noted in Bynum, the purpose of the test is to deny the defense to a government contractor "that is itself ultimately responsible for the design defect." 770 F.2d at 574.

The third element of the Boyle defense requires that the government contractor warn the government when the contractor has information which the government lacks. This element clearly contemplates that the government's approval of the design will involve informed decisions and considered choices. As we noted in Bynum, the primary purpose of the warning element is "to enable the government to make determinations as to the design and use of military equipment based on all readily available information." Id. at 574. The Court's inclusion of a warning element must indicate that approval requires some level of evaluation and review; otherwise a government contractor might argue one day that it should have the benefit of the defense despite its failure to give a warning because the government had rubber-stamped the design, because the information withheld would have been of no use to the government and was not desired by the government, and because the provision of the information would not have affected the government's "approval" of the design. The Supreme Court noted that the warning requirement prevents the defense from creating an incentive to withhold information: "We adopt this provision lest our effort to protect discretionary functions perversely impede them by cutting off information highly relevant to the discretionary decisions." 108 S.Ct. at 2518. That purpose would be a farce if the government could approve specifications without evaluating them.

In discussing the federal interests involved, Boyle gives two hypothetical cases in which the government contractor defense would not apply. First, if the United States contracts for the purchase and installation of an air conditioning unit, specifying the cooling capacity but not the precise manner of the construction, and the state law required a duty of care to include a certain safety feature, "no one suggests that state law would generally be pre-empted in this context." 108 S.Ct. at 2516. Second, if a federal procurement officer orders, by model number, a quantity of stock helicopters that happen to be equipped with improperly designed escape hatches, the government's order would not establish its significant interest in that particular design. "That would be scarcely more reasonable than saying that a private individual who orders such a craft by model number cannot sue for the manufacturer's negligence because he got precisely what he ordered." Id. These examples do not square with an interpretation of the Boyle defense that contemplates approval without evaluation. In both cases the government has no interest in the defective design feature because the contractor, not the government, exercised discretion over the design choice. If discretion is unimportant to approval, if the government may approve by rubber stamp, then the government ought to be able to approve the design by accepting and using the air conditioning unit or by ordering and accepting delivery of the helicopters. Boyle clearly indicates that such "approval" would be insufficient.

Decisions in the circuit courts prior to Boyle also support our holding. The Third Circuit flatly held that the government's approval must consist of "more than a mere rubber stamp." In re Aircrash Disaster, 769 F.2d at 122. The Third Circuit held that the government's approval of a design satisfies the first element of the government contractor defense if it comes "after a substantive review of the specifications." Id. at 123. The case of Shaw v. Grumman Aerospace Corp., 593 F. Supp. 1066 (S.D.Fla. 1984), aff'd, 778 F.2d 736 (11th Cir. 1985), cert. denied, ___ U.S. ___, 108 S.Ct. 2896, 101 L.Ed.2d 930 (1988), presents almost exactly the same relationship between the United States Navy and a military contractor as we find in the present case. Shaw concerned defects in the design of the Navy's A-6 aircraft. The district court found that the Navy provided general performance, mission and criteria specifications to Grumman, that Grumman exclusively designed the aircraft and submitted the detailed specifications to the Navy, that the Grumman drawings were routinely examined and approved by Navy personnel, that the Navy did not evaluate the design data or check the accuracy or compliance of the drawings, that Grumman in fact had final control of the design of the aircraft, that Grumman decided to use a defectively-designed stabilizer system on the aircraft, and that the Navy was not aware of the design defect at the time of approval. Id., 593 F. Supp. at 1070-73. Moreover, after the defect was discovered by the Navy, the Navy requested Grumman to solve the problem. Grumman designed "self-retaining bolts" for the stabilizer system, and the Navy installed them as instructed, but this modification was also defective. 778 F.2d at 738. Although the district court explicitly found the Navy had approved the defective design, both the district court and the Eleventh Circuit discounted that approval because it was merely a rubber stamp. The Eleventh Circuit noted that the Navy "relied" on Grumman's advice and that the approval did not constitute an "informed military decision." Id. at 747. The Eleventh Circuit affirmed the holding that the military contractor defense was not available to Grumman, but that court went further and changed the elements of the defense. The new defense did not examine the exercise of discretion but keyed immunity to the level of contractor participation in the design process. See id. at 746.

The Supreme Court in Boyle specifically rejected the Eleventh Circuit's formulation of the military contractor defense: "[I]t does not seem to us sound policy to penalize, and thus deter, active contractor participation in the design process, placing the contractor at risk unless it identifies all design defects." 108 S.Ct. at 2518. Boyle rejected the Shaw formulation of the defense because it was not "designed to protect the federal interests embodied in the `discretionary function' exception." Id. But the Supreme Court never indicated that the result reached in Shaw was incorrect. The district court in Shaw had applied the formulation of the defense that was adopted in Boyle and held the Navy's "approval" of the A-6 was insufficient to satisfy the government contractor defense. See 593 F. Supp. at 1074.

Not only does a careful analysis of the elements of the government contractor defense suggest that a rubber stamp is insufficient approval, the Supreme Court's rejection of the Feres-Stencel doctrine and recognition of the discretionary function exception as the basis for this defense mandates that result. In McKay v. Rockwell Int'l Corp., 704 F.2d 444 (9th Cir. 1983), the Ninth Circuit was confronted with an older case that had apparently conditioned the government contractor defense upon the exercise of design discretion. In Merritt, Chapman Scott Corp. v. Guy F. Atkinson Co., 295 F.2d 14 (9th Cir. 1961), a private firm had contracted with the government to build a dam, and the contract had specified the location, height, and some performance requirements of the upstream cofferdam but left the design, materials and method of construction to the discretion of the contractor. The Ninth Circuit held that the government contractor defense was not available to shield the contractor from liability for damages caused by the collapse of the defective cofferdam. Id. at 15-16. The McKay court concluded "[u]nder these circumstances, Merritt, Chapman properly precludes the government contractor rule. When only minimal or only very general requirements are set for the contractor by the United States the rule is inapplicable." 704 F.2d at 450. But the McKay court went on to hold that "[t]he situation is different where the United States reviewed and approved a detailed set of specifications." Id. (emphasis added). But the question remained how much review is necessary and what constitutes approval. The Ninth Circuit held that "[i]t is at this point that the Feres-Stencel doctrine comes sharply into focus," id., and concluded that the Feres-Stencel doctrine required a broader application of the rule than Merritt, Chapman might suggest, id. 704 F.2d at 450-51. Yet the Supreme Court in Boyle rejected Feres-Stencel as the basis of the government contractor defense both because it was too narrow in that it did not cover suits by civilians and because it was too broad in precluding recovery for some injuries that were not in any way the result of the exercise of government discretion. See Boyle, 108 S.Ct. at 2517. Boyle rejected the Feres-Stencel doctrine because it defines the federal interests in terms of the military subject matter of the case, regardless of whether any discretion was exercised by the government.

The Supreme Court's choice of the discretionary function exception is also important because it imports into this area of the law the policies underlying that provision, which are quite different from those underlying the Feres-Stencel doctrine, and a rich case law defining what the government's exercise of discretion is and what it is not. The Feres-Stencel doctrine is strictly based on separation of powers concerns and the need to prevent any sort of "second-guessing" of military orders by civilian courts. See Stencel Aero Engineering Corp. v. United States, 431 U.S. 666, 673, 97 S.Ct. 2054, 2059, 52 L.Ed.2d 665 (1977). The discretionary function exception also seeks to "prevent judicial `second-guessing' of legislative and administrative decisions grounded in social, economic, and political policy through the medium of an action in tort." United States v. S.A. Empresa de Viacao Aerea Rio Grandense (Varig Airlines), 467 U.S. 797, 814, 104 S.Ct. 2755, 2765, 81 L.Ed.2d 660 (1984). However, this policy is balanced against the "broad and just purpose" of the FTCA to compensate victims of negligence in the conduct of governmental activities. Indian Towing Co. v. United States, 350 U.S. 61, 68, 76 S.Ct. 122, 126, 100 L.Ed. 48 (1955).

Courts have found it "unnecessary — and indeed impossible — to define with precision every contour of the discretionary function exception." Varig Airlines, 467 U.S. at 813, 104 S.Ct. at 2764; see also Williamson v. United States Dept. of Agric., 815 F.2d 368, 374-75 (5th Cir. 1987) (noting the difficult task of divining the boundaries of governmental discretion). The Supreme Court has held that the discretionary function exception turns on "the nature of the conduct, rather than the status of the actor," that the provision covers acts by all federal employees, regardless of rank, if the challenged acts are of the "nature and quality" to fall within the exception. Varig Airlines, 467 U.S. at 813, 104 S.Ct. at 2764. The court must determine whether the judgment exercised is of the kind that the discretionary function exception was designed to shield. Berkovitz by Berkovitz v. United States, ___ U.S. ___, 108 S.Ct. 1954, 1959, 100 L.Ed.2d 531 (1988). The courts have been adamant about one point, however: not all decisions made by government employees are covered by the discretionary function exception. "Every act of a rational being involves some choices," and the discretionary function exception must be read carefully or it will totally insulate the government from tort liability. Collins v. United States, 783 F.2d 1225, 1233-34 (5th Cir. 1986) (Brown, J., concurring). Courts have generally drawn a line between decisions at a planning level, or decisions that exercise policy judgment, and decisions at a operational level, or decisions that are merely incident to carrying out a government policy. See Dalehite v. United States, 346 U.S. 15, 35-36, 73 S.Ct. 956, 968, 97 L.Ed. 1427 (1953). "Discretionary decision-making . . . is accompanied by nondiscretionary acts of execution, whether termed operational, ministerial, or clerical." Payton v. United States, 679 F.2d 475, 480 (5th Cir. Unit B 1982) (en banc). Once the government makes a discretionary decision, the discretionary function exception does not apply to subsequent decisions made in the carrying out of that policy, "even though discretionary decisions are constantly made as to how those acts are carried out." Wysinger v. United States, 784 F.2d 1252, 1253 (5th Cir. 1986). The decisions of this circuit have been extraordinarily careful to avoid any interpretation of the discretionary function exception that would embrace any governmental act merely because some decision-making power was exercised by the official whose act was questioned. See, e.g., Denham v. United States, 834 F.2d 518, 520 (5th Cir. 1987) (noting that the "government's approach would subsume practically any decision within the discretionary function exception and thereby vitiate the FTCA"); Smith v. United States, 375 F.2d 243, 246 (5th Cir.) (noting that a broader reading of the exception would destroy the "corpuscular vitality" of the Federal Tort Claims Act), cert. denied, 389 U.S. 841, 88 S.Ct. 76, 19 L.Ed.2d 106 (1967).

Although the planning/operational distinction does not always work, a government decision, at a minimum, must involve judgment or policy choice to fall within the discretionary function exception. See Berkovitz, 108 S.Ct. at 1958-59; Dalehite, 346 U.S. at 34, 73 S.Ct. at 967. The discretionary function exception "properly construed, therefore protects only governmental actions and decisions based on considerations of public policy"; discretionary decisions involve "the permissible exercise of policy judgment." Berkovitz, 108 S.Ct. at 1959. The Boyle Court noted that the selection of the appropriate design for military equipment to be used by our armed forces is a discretionary function because it involves "not merely engineering analysis but judgment as to the balancing of many technical, military, and even social considerations, including specifically the trade-off between greater safety and greater combat effectiveness." 108 S.Ct. at 2517.

In discretionary function cases, the Supreme Court has recognized that a government agency may delegate its discretion to private parties. In Varig Airlines, the government answered a suit against the FAA for certifying a dangerously defective plane that the responsibility for safety rests with the airplane manufacturer and that the government may enforce those safety standards with "spot checks"; the Court agreed and held that the government's decision to use spot checks was a discretionary function. 467 U.S. at 815, 104 S.Ct. at 2765. The Court specifically noted that the discretionary function exception protects "policy judgments regarding the degree of confidence that might reasonably be placed in a given manufacturer." Id. at 820, 104 S.Ct. at 2768. In fact, the Boyle Court noted that "[t]he design ultimately selected may well reflect a significant policy judgment by Government officials whether or not the contractor rather than those officials developed the design." 108 S.Ct. at 2518.

If the government has chosen to delegate its design discretion to a private contractor, however, the government does not exercise a discretionary function by merely approving the contractor's work. This circuit confronted that issue in Butler v. United States, 726 F.2d 1057 (5th Cir. 1984). In Butler the families of eight persons who had drowned in an underwater depression created by an Army Corps of Engineers project sued the government and the private contractors that had performed work for the Army Corps of Engineers. The project was the repair of a seawall in Hancock County, Mississippi, that was damaged in a hurricane. The sand needed for the repair was obtained by the dredging the Mississippi Sound, thereby creating a depression in shallow water near a popular beach. The Army Corps of Engineers contracted out the operation to Farrell Construction Co., who subcontracted parts of it to two other companies. The contract provided that the Army Corps of Engineers would retain ultimate control, would approve all plans, shop drawings, construction practices, methods and materials and that completion of the project was subject to the inspection and acceptance by the Corps. The contract also required the posting of warning signs for swimmers. The suit alleged that the warnings were inadequate. See id. at 1059-60. In determining the government's liability, this court held that the preparation of the contract was a discretionary function but that the "controlling, supervising, contracting and carrying out of the contract" were not discretionary; those actions were operational in nature and did not enjoy immunity under the discretionary function exception. Id. at 1062. This court held that the decisions by the Army Corps of Engineers to repair the seawall and to dredge the sound were discretionary, but "once these decisions were made, the Government was no longer exercising a discretionary function." Id. at 1063. This is not to say that it is impossible for the government to exercise a discretionary function when supervising a private contractor, but only that once the government has delegated authority to the private contractor to make important choices, the government does not exercise a discretionary function by merely accepting the contractor's work.

To summarize: The government contractor defense as reformulated in Boyle protects government contractors from liability for defective designs if discretion over the design feature in question was exercised by the government. If the government delegates its design discretion to the contractor and allows the contractor to develop the design, the government contractor defense does not apply. If the government has so delegated its discretion to the contractor, mere government acceptance of the contractor's work does not resuscitate the defense unless there is approval based on substantive review and evaluation of the contractor's design choices. A mere rubber stamp by a federal procurement officer does not constitute approval and does not give rise to the government contractor defense.

C. The District Court's Application of the Defense

General Dynamics argues that the Navy approved the design specifications set forth in each of the General Dynamics' working drawings, and points to the signature of a government official in a box marked "approved" at the bottom of each of the working drawings. The district court, however, found that "the level of review here was not sufficient to constitute `approval'." 626 F. Supp. at 1336. The district court held that contracts "left design entirely to the discretion of General Dynamics. The Navy set only general performance standards leaving the details to General Dynamics." Id. at 1335-36. The district court held that the COR promulgated by the Navy was "silent" on the questions of the precise location of the main hangar vent valve and the use of warning or safety devices. "The evidence shows that such determinations were left to the discretion and expertise of the General Dynamics designers assigned to prepare the working drawings." Id. at 1336. These findings are not clearly erroneous. The record reveals that Navy personnel at MINS assigned a relatively low priority to the GRAYBACK work and delegated their design discretion to General Dynamics. Paul Lawrence, the section leader of the Navy group in charge of the hangar flood and drain system design for the GRAYBACK, wrote in a memo to his superiors at MINS in 1969: "The design work on the GRAYBACK was initially given a low work priority due to more important shipyard work. . . . Due to this extremely heavy workload the piping branches were required to assign less experienced engineers/technicians to GRAYBACK than would normally be assigned. In many cases, farm-in personnel were used to man the GRAYBACK work. . . . Most of the GRAYBACK design work was accomplished by farm-in contractor personnel and not checked by Mare Island experienced technical people." After the accident, the Navy investigation concluded that one of the problems with the GRAYBACK design was the absence of a formal Navy design review. Because the record clearly shows that "General Dynamics, rather than the government, was ultimately responsible for the design defects in the [diving] hangar aboard the GRAYBACK," id. at 1338, the district court was correct in holding that the approval element of the government contractor defense was not satisfied.

The district court noted that the second element, that the product comply with the design specifications, was not implicated in this case because General Dynamics only did the design work, not the manufacturing of the product. Id. at 1337-38. Furthermore, it is undisputed that the Navy in converting the GRAYBACK followed General Dynamics's specifications exactly. The district court noted, however, "that the system as designed by General Dynamics did not even conform to the general requirements provided by the government." Id. at 1338. Under the General Dynamics design the vent valve was not controllable from the air bubble as required by the COR. This finding does not go to the second element because the working drawings, not the COR, were the reasonably precise specifications.

The district court also held that General Dynamics had failed to prove the final element of the defense, that it had warned the government about the dangers in the use of the equipment that were known to the contractor but not to the United States. The district court committed two errors in this holding. First, it held General Dynamics to a duty to warn the government of dangers about which it "knew or should have known." After Boyle a government contractor is only responsible for warning the government of dangers about which it has actual knowledge. Second, the district court held that General Dynamics should have warned the Navy of the possibility that a vacuum would form while draining the diving hangar, even though both the Navy and General Dynamics knew or should have known of the dangers associated with the system's potential to create a partial vacuum. After Boyle, a government contractor only has the duty to warn the government of dangers of which it has knowledge but the government does not. Because both General Dynamics and the Navy knew that the system as designed could create a partial vacuum, and because both the Navy and General Dynamics could see that the final design included no safety devices, liability of General Dynamics could not be based upon non-disclosure of these dangers. Because the Navy delegated its design discretion to General Dynamics, however, and thus never approved reasonably precise specifications within the meaning of Boyle, the district court's holding that the government contractor defense was not available to General Dynamics in this case was correct.

III. The Borrowed Servant Doctrine

General Dynamics alternatively argues that its employees who worked on the design of the GRAYBACK at MINS were borrowed servants of the Navy and therefore the Navy, and not General Dynamics, was responsible for their defective design choices. The district court, however, held that "General Dynamics was an independent contractor given discretionary, independent decision-making authority and, therefore, its employees were not borrowed servants of the government." 626 F. Supp. at 1340. Whether an employee of one is a "borrowed servant" of another is a factual question. Among the considerations for determining whether a servant has been borrowed by another employer are who has control over the employee and the work he is performing, beyond mere suggestion of details or cooperation; whose work is being performed; and who pays the employee. See Alday v. Patterson Truck Line, Inc., 750 F.2d 375, 376 (5th Cir. 1985). No one factor or combination of factors is decisive and no test has been fixed to determine the existence of a borrowed servant relationship. Id. The degree of control an employer has over the employee and the employee's work, however, has generally been considered to be the most important of the considerations. See West v. Kerr-McGee Corp., 765 F.2d 526, 530-31 (5th Cir. 1985); Hebron v. Union Oil Co. of California, 634 F.2d 245, 247 (5th Cir. Unit A Jan. 1981).

The district court's findings of fact on the government contractor defense largely answer this issue as well. The Navy contracted with General Dynamics to have General Dynamics perform a specific task for the Navy and delegated the Navy's design discretion over the GRAYBACK conversion to General Dynamics. The Navy did not, therefore, control the work of General Dynamics or its employees. The district court also found it significant that the Navy hired General Dynamics specifically because its employees were experienced and would not need supervision, that the Navy did not intend to control or supervise the particulars or actual details of the General Dynamics employees' work, that the Navy did not direct the tasks of General Dynamics's employees but spelled out specifically their duties in a contract, that General Dynamics maintained its employer/employee relationship and retained the obligation to pay its employees, and that General Dynamics maintained an administrative structure among its employees while they were at the MINS facility. 626 F. Supp. at 1339-40. The district court's findings are not clearly erroneous.

IV. The Navy's Negligence

General Dynamics next argues that the district court's findings of causation were clearly erroneous and that the negligence of the United States Navy was the sole cause of the accident. Under Texas law, "[t]he act of a third person which intervenes and contributes a condition necessary to the injurious effect of the original negligence will not excuse the first wrongdoer if that act ought to have been foreseen." Clark v. Waggoner, 452 S.W.2d 437, 440 (Tex. 1970). General Dynamics, however, notes that under § 452(2) of the Restatement (Second) of Torts (1965) the duty to prevent harm to another threatened by the actor's negligent conduct may be shifted to a third party if, because of the lapse of time, the magnitude of the risk of harm, the character and position of the third party, his knowledge of the danger or his relationship to the plaintiff, the failure of the third party to prevent the harm is a superseding cause. It is unclear whether Texas recognizes § 452. Cf. French v. Grigsby, 571 S.W.2d 867, 867 (Tex. 1978) ("Since the advent of comparative negligence with the adoption of art. 2212a, Tex. Rev. Civ. Stat. Ann., this court has sought to abolish those doctrines directed to the old choice between total victory and total defeat for the injured plaintiff.")

General Dynamics's design was negligent; however, the Navy knew or reasonably should have known of the dangers inherent in the design. The Navy chose to use the GRAYBACK as designed and dealt with the possibility of a vacuum by training its employees rather than by modifying the submarine. Furthermore, the Navy exacerbated the dangers by failing to lubricate the shaft of the valve properly, making it more difficult to turn and more likely that a diver would not realize that it was partially closed. Nevertheless, the Navy relied on General Dynamics's design expertise, and that reliance and the Navy's use of the defective design were foreseeable by General Dynamics. Moreover, the Navy's method of dealing with the dangers in the design were effective for thirteen years. The district court held that the Navy's negligence was not the sole cause of the accident and that the circumstances of the Navy's negligence were not of such a character as to sever the chain of causation and shift all responsibility from General Dynamics to the Navy. The district court found that both the Navy and General Dynamics were negligent and assigned 80% of the fault to General Dynamics and 20% of the fault to the Navy. We cannot say that those findings are clearly erroneous.

V. The Indemnification Agreement

The contracts between General Dynamics and the United States provide that the government will indemnify General Dynamics for liabilities arising out of the performance of the contract. The district court held that General Dynamics had failed to satisfy one of the conditions of the contract and was therefore not entitled to indemnification from the government. We hold, however, that the district court was without jurisdiction to consider this question, and we therefore vacate the judgment on this issue.

General Dynamics's claim is a contract claim, and the essence of the claim is to obtain money from the government. The action must proceed, therefore, under the applicable provisions of federal statutes regarding government contracts. See Amoco Production Co. v. Hodel, 815 F.2d 352, 361 (5th Cir. 1987), cert. denied, ___ U.S. ___, 108 S.Ct. 2898, 101 L.Ed.2d 932 (1988). General Dynamics's claim is controlled by the Contract Disputes Act. 41 U.S.C. § 601 et seq. Under the Act, § 609(a)(1), a contracting party may bring an action directly on the contract claim against the United States after an adverse decision by a contracting officer concerning the claim. All claims by a contractor against the United States relating to a contract must be submitted in writing to a contracting officer for a decision. 41 U.S.C. § 605(a). General Dynamics never did so prior to filing this counter-claim against the United States. General Dynamics claims that its tender of a defense of this action to the United States Justice Department constituted a claim to a contracting officer. A contracting officer, however, is defined as a person who has the authority to enter into and administer contracts and make determinations and findings with respect thereto. 41 U.S.C. § 601(3). The Justice Department certainly cannot enter into contracts for the Navy and is not a contracting officer for the purposes of the Contract Disputes Act. The decision, or failure to decide, by a contracting officer is an absolute jurisdictional prerequisite to filing a suit under the Contract Disputes Act. See Thoen v. United States, 765 F.2d 1110, 1116 (Fed. Cir. 1985); Paragon Energy Corp. v. United States, 645 F.2d 966, 971, 227 Ct.Cl. 176 (1981). The district court was therefore without jurisdiction to decide General Dynamics's cross-claim against the United States for indemnification.

The judgment for plaintiffs against General Dynamics is AFFIRMED; the judgment on the cross-claim by General Dynamics, seeking contractual indemnity from the United States, is VACATED.