Decide which AI-assisted actions need a person’s decision before they affect a customer. Use the approval record, worked example, and state-by-state guidance below to define who can approve, when permission expires, and what happens when an action must wait.
An approval gate is a pause before a specific action, not blanket permission for everything an assistant may do next. Start by listing the action, its destination, the people affected, and what would happen if it were wrong. A draft that stays in a review queue is different from the same text sent to a customer.
Consider allowing summaries, classifications, and unsent drafts automatically when the source data is authorized and the output stays in a controlled workspace. Review exceptions such as sensitive information, uncertain facts, or conflicting records.
Require a designated reviewer for commitments, price exceptions, refunds, cancellations, sensitive replies, or changes to customer records. Choose the threshold for your workflow; a dollar amount alone will not capture privacy or reputational risk.
The NIST AI Risk Management Framework is voluntary guidance for incorporating trustworthiness considerations into AI design, use, and evaluation. The record and state model below are practical design recommendations, not a prescribed NIST form or a compliance certification.
Present the full customer-visible message or a before-and-after record change, the intended recipient, the source facts, and any uncertainty. Assign a primary approver and a backup with authority for that action. Authenticate the reviewer in the approval system; a visitor saying “the owner approved” is not authorization.
Bind each decision to an immutable revision of the proposed action. Immediately before execution, check the approval, expiry, recipient, permissions, and relevant source facts again. An approval to send one message must not authorize a different message, a second recipient, or an unrelated update.
Select and copy this plain-text record into your workflow documentation or review queue. Use references to access-controlled evidence rather than copying unnecessary personal information into the log.
Request ID: [unique identifier]
Action revision: [version / exact payload reference]
Created at: [date, time, timezone]
Requested action: [one specific send, update, booking, or other action]
Destination and recipient / record ID: [exact target]
Proposed message or before-and-after change: [full content / controlled reference]
Source evidence and checked at: [references, timestamps]
Consequence and uncertainty: [customer impact, amount, missing facts]
Approval rule: [why manual approval is required]
Primary approver / backup: [authorized roles or people]
State: [draft / pending / approved / rejected / expired / executing /
succeeded / failed / outcome-unknown / superseded]
Decision: [approve exact revision / reject / request edit]
Reviewer identity, decision time, rationale: [verified identity and note]
Expires at: [date, time, timezone]
Invalidation conditions: [changed recipient, content, availability, or facts]
If no valid approval: [hold action; notify named queue / backup]
Execution ID / duplicate-prevention key: [unique action identifier]
Execution receipt / reconciliation evidence: [destination result reference]
Handoff owner, next step, and due time: [explicit assignment]Fail closed: If authorization, evidence, expiry, or the approval service cannot be checked, hold the consequential action. Preserve the draft and send a minimal handoff to the designated queue. The handoff should state what is blocked, what is known, who owns the next decision, and when review is due. A backup notification does not extend the approval deadline.
Illustrative only: A fictional service business receives a request from Sample Customer for a Tuesday visit. Its assistant drafts “We can offer Tuesday at 10 a.m.; please reply to confirm.” The business requires review before offering a specific time. No appointment has been booked.
Use synthetic records and a non-delivering test destination. Verify that an authorized reviewer can approve the exact revision and that the destination records one action. Then test expired approval, a changed recipient, edited wording, an unauthorized reviewer, an unavailable approval service, duplicate clicks, and a timeout after simulated delivery.
Pass only when invalid approvals produce no consequential action, valid approval produces the intended action once, and each blocked or uncertain case has an owner and an evidence trail. Keep the workflow paused if the evidence cannot establish what happened. Human review can miss errors, so retain access limits, validation, and destination checks alongside the gate.
Bring one proposed action, a sample draft with personal details removed, and the role responsible for approval. Start with a narrow workflow whose decisions can be reviewed clearly.
These references support the public planning guidance above.