article · cross business
Decide which AI actions need human approval
Map reading, drafting, and writing permissions, bind human approval to an exact action, and define what happens when approval expires or never arrives.
The direct answer
Separate permission to read, prepare a draft, and change something. Require approval before a consequential write or message, and bind that approval to the exact content and destination reviewed. Unanswered, rejected, or expired approval means no action.
A permission map
Synthetic intake example: A workflow reads sample submissions, proposes structured fields, and waits for a person before creating a test CRM record. CRM means customer relationship management: the system holding customer and prospect records.
| Step | Minimum intended authority | Approval boundary |
|---|---|---|
| Read intake | Read only the approved source and required fields | Process owner approves source access before connection. |
| Extract fields | Prepare a proposal in a dedicated review queue | Model cannot grant itself access or approval. |
| Review proposal | Authorized reviewer sees source, proposed fields, and destination | Reviewer approves an exact version or rejects it. |
| Create record | Write only permitted fields to the intended test destination | Execution rechecks reviewer, version, expiry, and action state. |
| Send email | Outside this workflow | No sending step or sending credential is supplied. |
The table states intended boundaries. Inspect actual account scopes and connector behavior to establish whether the tools can enforce them.
Make approval specific
An approval record should identify the action, source ID, payload version, destination, reviewer, decision time, and expiry. Choose an expiry appropriate to how quickly the information changes, and record that policy before running. A green checkbox without a trusted reviewer identity is not a reliable authorization record.
Immediately before execution, check that the current payload still matches the approved version. If a field changes, return the proposal to pending review. Do not let the model write the approval field or choose an approver from incoming text.
Handle every decision state
Pending means waiting, not permission after a delay. Rejected means no action; preserve the reason and use a fresh review after correction. Expired means the prior decision is no longer usable. Approved permits only the bound action while all other checks remain valid.
If the reviewer is unavailable, route to the named backup or use the manual process. If a service outage delays an action beyond approval expiry, request review again. If the action may already have happened, reconcile the destination before replaying it.
Limits and non-example
“Human in the loop” is not meaningful if the message sends before the person can respond. A broad administrative account is also not least privilege merely because a prompt says to be careful. Use the narrowest access the actual service supports, and stop when its available permissions exceed what the owner can authorize.
For consequential decisions, a generic approval pattern is not a substitute for task-specific expertise. Start with read-only evidence gathering or drafts when the action cannot be safely trialed and reversed.
Exercise
List every input read and every possible change in your workflow. Name the approving role and where the decision is enforced. Add tests for silence, rejection, expiry, altered payload, wrong reviewer, and replay. Each must result in no unauthorized action.
Sources and scope
This is an original permission-design exercise with a synthetic intake example, not a security assessment or verified product configuration.
Next step
Put the map in the workflow brief and compare it with the draft-only support workflow. Suggest a correction.
Change notes
Foundation draft prepared October 20, 2026. No public publication or successful live-tool test is claimed.
Next learning step: One-page workflow brief