Place approval gates according to action impact, uncertainty and reversibility. Low-risk reversible actions may run within limits. Consequential or uncertain actions need an authorised person who sees the source evidence, proposed change, rationale and downstream effects. Enforce the gate server-side, record the decision and preserve rollback.
This is an AI governance and operational risk design problem. A human click adds little safety when the reviewer lacks information, authority or time.
NIST recommends defining human oversight roles, mapping impacts and implementing appeal, override, incident response, recovery and change management for AI systems Source: NIST.
Inventory automated actions
List every action the system can propose or execute: send, approve, reject, price, pay, delete, publish, assign, update, export or escalate. Include indirect actions triggered through tools and integrations.
Record affected records, people, systems and business outcomes. Do not classify only the model response when a tool call creates the consequence.
Score impact and reversibility
Assess financial, legal, privacy, safety, customer, employment, reputation and operational impact. Score how quickly and completely the action can be reversed and who bears the harm.
A reversible draft is different from a sent termination notice. A record update may appear reversible but still trigger irreversible downstream communication.
Define action tiers
Create tiers such as observe, draft, propose, approve, execute and prohibit. Set volume, value and confidence boundaries. Escalate novel and out-of-policy cases.
Examples: low-risk internal classification may run automatically; customer communication may require review; payment, access removal or adverse decisions need stronger independent approval; prohibited actions never reach the tool.
Document the reason and owner for each tier.
Design the evidence packet
Show the reviewer the original record, relevant source data, proposed action, changes, model or rule rationale, uncertainty, policy, prior decisions and downstream effects. Highlight missing or conflicting data.
Do not ask reviewers to approve from a vague summary. Preserve links to the authoritative system.
Assign authorised decision rights
Map approval authority by action, value, business unit and risk. Separate request, approval and execution where fraud or conflict risk warrants it. Provide deputies and escalation.
Do not route every decision to the most senior executive. Choose people with domain expertise and delegated authority.
Review access regularly and remove departed staff.
Enforce the gate outside the model
Treat model output as a proposal. The application and tool layer should validate policy, permission, limits and approval token before executing. Use allowlisted operations and parameters.
Do not rely on a prompt instruction saying “ask first.” An agent can misunderstand or be influenced by untrusted input.
Make direct API and manual bypasses subject to equivalent controls.
Set expiry and change invalidation
Approvals should expire after an appropriate period. Invalidate approval when source data, amount, recipient, content, model version or policy changes materially.
Bind the approval to the exact action payload and version. A signed approval for one customer must not authorise a batch.
Show reviewers when information changed after they opened the task.
Prevent rubber-stamping
Limit queue size and reviewer load. Prioritise by consequence and expiry. Sample lower-risk actions rather than routing every trivial item through a person.
Measure time spent, corrections, disagreement and overrides. Rotate reviewers and audit patterns. Provide an easy reject and request-information route.
A gate that receives thousands of low-value alerts trains people to approve without thought.
Plan disagreement and appeal
Define what happens when the reviewer disagrees with the system, another reviewer or the requester. Route to the correct authority and preserve reasons.
Provide affected people with an appropriate challenge or correction route when decisions matter. NIST includes appeal and override mechanisms in post-deployment monitoring Source: NIST.
Do not let the system repeatedly resubmit a rejected action unchanged.
Preserve a complete audit trail
Record trigger, actor, source references, model and prompt version, proposed payload, reviewer, decision, reason, timestamps, executed payload, tool response and before-values. Protect the log.
Use correlation identifiers across systems. Define retention and access based on legal and operational needs.
Do not log unnecessary personal information or secrets.
Build rollback and containment
Store before-values, use idempotent actions and design compensating operations. Set transaction and daily limits. Provide a kill switch that disables the automation without disabling the business system.
Test reversal and incident response. A theoretical rollback is not enough when a batch of messages has already been sent.
For irreversible actions, move approval earlier and reduce permitted scope.
Test adversarial and edge cases
Include misleading CRM notes, prompt injection, conflicting records, duplicate approvals, expired tasks, changed data, unavailable reviewers and partial execution. Verify fail-closed behaviour for high impact.
Test the complete workflow, not only model accuracy. Confirm that rejected and expired actions cannot execute through another interface.
Keep expected outcomes and regression tests versioned.
Address privacy and automated decisions
Map personal information, purpose, lawful processing, security and data subject effects. Review POPIA and sector obligations with qualified legal advisers.
POPIA addresses conditions including purpose, information quality, openness, safeguards and certain automated decision-making contexts Source: South African Department of Justice.
Human involvement must be meaningful, not ceremonial, where law or fairness requires it.
Monitor the gate itself
Track proposal volume, approval rate, rejection reasons, correction, expiry, queue time, execution errors, reversals, incidents and outcomes. Segment by action type, reviewer and version.
High approval rate can mean high quality or rubber-stamping. Review sampled evidence. High rejection may reveal poor data, prompts or policy fit.
Retire gates that add no control and strengthen gates where harm escapes.
Increase autonomy gradually
Begin with observation and drafts. Move to human-approved execution only after representative tests. Allow limited autonomous actions when quality, monitoring and reversibility justify it.
Define the evidence required for each promotion and the conditions that reduce autonomy again. Preserve manual fallback.
NIST recommends continual improvement based on measured post-deployment evidence Source: NIST.
My take: approval is a control system
My take is that human approval works only as a designed control system. The person needs the right evidence, time, authority and recovery route. Adding a button at the end of an opaque workflow creates accountability theatre.
If your business needs a practical starting point, choose the highest-impact automated action and test whether an independent reviewer can detect five seeded errors using only the proposed approval screen.
Frequently asked questions
Should every AI action require approval?
No. Gate by impact, uncertainty and reversibility. Excessive low-risk review can weaken attention for high-risk work.
Is a confidence threshold enough?
No. Confidence may be poorly calibrated and does not represent consequence. Combine evidence, policy, risk and validation.
Who should approve high-impact actions?
An authorised person with relevant expertise, independence where needed and enough context to stop or change the action.
What if the approval queue becomes too large?
Reduce scope, improve quality, sample low-risk work or add capacity. Do not accept rubber-stamping as human oversight.
Make human review a real safety mechanism
If your business needs governed automation, get in touch for AI automation and risk-aware process design.
Related guides
For further background, read our ai crm integration and sales marketing ai workflows. The ai crm integration glossary explains the terminology used in those guides.