AI Approval Workflow: What an Agent Asks Before It Acts

TL;DR: An AI approval workflow sorts everything an agent can do into three tiers. Drafts, research and summaries run alone. Posting, sending, spending and scheduling wait for a named person to say yes. Credentials, permissions, deletions and money stay person-only. Write the tiers down, put them in the system, and batch the asks.

An AI approval workflow answers the question every owner hits the week an agent goes live: what is this thing allowed to do without me?

Most of what you will find on the topic is a setup guide for one product. Click here, add an approval step, pick an approver. That part is quick. The part that takes thought is the policy behind it, and no product can decide that for you.

So here is the policy: three tiers, who approves what, how the ask should arrive, and how to keep the yes meaningful when the agent asks dozens of times a week.

What is an AI approval workflow?

An AI approval workflow is a written rule set, enforced by the software, that decides which agent actions happen on their own, which pause for a person's yes or no, and which the agent cannot do at all.

Think of a new hire's first month. They can read anything and draft anything. They need a sign-off before a client email goes out or a purchase goes through. And they never get the admin password, no matter how good they are.

The difference with an AI agent is volume. A person asks for a sign-off a few times a day. An agent can line up more actions before lunch than a person asks about all week. That is why the AI approval workflow has to be decided up front and built in, not improvised one message at a time.

It is also where "human in the loop" stops being a slogan. A person in the loop only helps if the loop says when they are needed, what they are deciding, and what happens if they do not answer.

Why does an AI agent need to ask before it acts?

Because agents make mistakes for reasons no employee would, and the damage scales with what they can touch.

The OWASP Top 10 for LLM Applications calls this risk excessive agency: "the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM." Its causes are too much functionality, too many permissions or too much autonomy, and one listed fix is to "require a human to approve high-impact actions before they are taken." (OWASP GenAI Security Project, LLM06:2025)

OWASP's own example: an assistant set up to read email uses a tool that can also send. A message with hidden instructions arrives, and the agent forwards private mail to an outsider. One of the fixes OWASP lists is a person who reviews each drafted email and sends it by hand. That is an AI approval workflow in one sentence.

Six national cyber agencies said the same thing in 2026. Joint guidance from the Canadian Centre for Cyber Security, Australia's ACSC, CISA, the NSA, and the national cyber centres of New Zealand and the UK tells organizations to "prevent agents from autonomously executing high impact actions or outputs without prior human approval," and to classify agent actions "by potential impact, likelihood and reversibility." (Canadian Centre for Cyber Security and partners, Careful adoption of agentic AI, 2026)

Impact and reversibility are the two words to build on. A good AI approval workflow is mostly a list of actions sorted by two questions: how bad if it is wrong, and can we undo it?

The three tiers: what runs alone, what waits, what only a person does

Here is the AI approval workflow we recommend, and the one we run our own agents on. Adjust the lists to your business, but keep the three buckets.

Tier 1: runs alone

Work that stays inside the building and can be thrown away if it is wrong: drafts of emails, posts and quotes; research and summaries; monitoring and reports; answers to internal questions; the morning brief.

None of it reaches a customer, spends money or changes a system of record. This is where an agent saves the most time, and it needs no approval, only good quality checks on the output.

Tier 2 of an AI approval workflow: tag and wait

Anything that leaves the building or costs something waits for a yes from a named person:

• Posting to social media or publishing to the website
• Sending email, texts or outreach, and any message to a client
• Spending money, even small amounts
• Booking or changing calendar events with outside people
• Deploying software or changing a client's site

"Tag and wait" means exactly that. The agent tags the person who owns that area with one clear question, shows the thing it wants to do, and waits. No answer means no action.

Tier 3: person-only actions

Some actions should stay out of the agent's reach even with approval, because the approval itself is the risk:

• Changing rules, instructions or the AI approval workflow itself
• Deciding who approves what, or granting permissions
• Creating, reading or rotating credentials
• Deleting records, files or accounts
• Moving money: payroll, payments, refunds, bank changes

A person does these in the application, signed in as themselves. The agent can suggest one ("this login looks unused, want to remove it?") and then stops. My rule of thumb: if a well-crafted email could trick the agent into doing it, it belongs in tier 3.

The agencies single out one item. Their guidance says to "quarantine requests to delete logs or audit records until they are reviewed and approved by a human." (Canadian Centre for Cyber Security and partners) An agent that can erase its own record is an agent nobody can check.

What should an AI agent never do without approval?

If your AI approval workflow has only one list, make it this one. An agent should never do these on its own:

1. Send anything to a customer. Email, text, chat reply, invoice note.
2. Publish anything public. Posts, replies to reviews, website pages.
3. Spend money. Purchases, subscriptions, trials that convert.
4. Delete. Records, files, accounts, logs.
5. Change access. Add a user, widen a permission, share a folder outside the company.
6. Touch credentials. Passwords, API keys, recovery codes.

The first three are tier 2: fine with a yes. The last three are tier 3. Our note on AI agent least privilege covers the other half, which is making sure the agent's account cannot do tier 3 things even if it tried.

Who should approve, and how should the ask arrive?

An AI approval workflow is only as good as the person giving the yes and the way the question is put.

One owner per area

Pick the approver by area, not by seniority. Whoever runs marketing approves posts. Whoever handles billing approves anything touching invoices. The owner approves spend above a line you set. If two people can approve the same thing, each assumes the other looked.

NIST's AI Risk Management Framework treats this as governance, not tech: policies should "define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems." (NIST AI RMF 1.0, GOVERN 3.2, January 2023) In a small business, that can be a five-line table taped to the wall.

One clear question in one approval queue

A good ask reads: "Want me to send this reply to the quote request from the Main Street job? Yes / No," with the full draft right underneath. A bad ask reads: "3 items need review," with a link to a dashboard. If the approver has to open four tabs to understand the ask, they will start approving without opening them.

All asks go to one approval queue or one private channel, never scattered across group chats, so everything waiting on a person is in one spot.

Escalation rules and quiet hours

Every AI approval workflow needs a rule for silence. Our default: one reminder, then the ask waits for the next morning brief. The agent does not route around the approver, and it never takes silence as a yes.

Quiet hours hold every ask until morning except a real outage or a security problem. A post can wait until 8am. A server that is down cannot. Write down which is which so the agent does not decide.

How do you stop approval fatigue in an AI approval workflow?

Approval fatigue is the quiet way an AI approval workflow fails. The asks come so often that the yes becomes a reflex, and a reflex is not a review.

Security teams have watched this happen with login prompts. CISA describes "MFA fatigue," also called push bombing, which "occurs when a cyber threat actor bombards a user with mobile application push notifications until the user either approves the request by accident or out of annoyance with the nonstop notifications." One fix CISA recommends is number matching, which makes the person look at the login screen before they can approve. (CISA, Implementing Number Matching in MFA Applications, October 2022)

Put those side by side. Too many prompts got people tapping yes without looking, and the fix was to make them look. The same moves keep an AI approval workflow honest:

• Batch similar asks. Ten social posts for next week are one ask with ten items, not ten pings.
• Show the actual thing. The draft, the amount, the recipient. Never a summary of it.
• Group repeats. The same alert six times is one message with a count.
• Retire asks that are always yes. If an action has been approved unchanged 50 times, a person can decide to move it down a tier, in writing. The agent never assumes it.

The EU AI Act names the same trap. Its human oversight article asks that people overseeing high-risk AI systems stay "aware of the possible tendency of automatically relying or over-relying on the output," and be able to stop the system with "a 'stop' button or a similar procedure." (EU AI Act, Article 14) That article is written for systems the law classes as high-risk, not for every agent. The checklist is still a good one.

My wife and partner, Amelia, makes a related point in AI agent governance: check the sequence, not each click (opens in a new tab). Reviewing every tiny step burns out the reviewer. Reviewing the moments where the agent crosses a line catches what matters.

Why does the rule have to live in the system, not the prompt?

Because a prompt is a request, and an agent can be talked out of a request.

OWASP puts it plainly: "Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not." (OWASP, LLM06:2025) The agencies add that decisions about when human approval is required should be set by the people who design or run the system, not handed to the agent. (Canadian Centre for Cyber Security and partners)

In practice, a working AI approval workflow means three things:

1. The send button is not in the agent's hands. The agent writes to a drafts folder or an approval queue, and only the approval step can release it.
2. Tier 3 is enforced by permissions. The agent's account has no rights to delete, pay or change access.
3. There is an off switch. NIST's framework calls for mechanisms "to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use." (NIST AI RMF 1.0, MANAGE 2.4)

Every ask, yes, no and timeout goes in a log, so you can see who approved what, when, and what they were shown. Our note on monitoring AI agents covers what that log should hold.

How do you write an AI approval workflow in one afternoon?

You need a spreadsheet and two hours with the people who will approve things.

1. List every action (30 minutes). For each agent, write down every action it can take. "Read the inbox." "Draft a reply." "Send a reply." Be literal.
2. Score each one (30 minutes). How bad if it is wrong (low, medium, high), and can you undo it (yes, partly, no).
3. Sort into the three tiers (15 minutes). When in doubt, go one tier stricter. You can relax it later with evidence.
4. Name the approvers (15 minutes). One name per area, plus a backup for vacations.
5. Set the timing rules (15 minutes). Quiet hours, one reminder, what counts as urgent, how asks are batched.
6. Check tier 3 against reality (15 minutes). Confirm the agent's account truly cannot do each item. If it can, fix the permission, not the prompt.
7. Book a review in 30 days. Look at what was approved, rejected and left waiting, then move items between tiers.

Picture a property management office in Leominster running an agent on its maintenance inbox. In this hypothetical AI approval workflow, tier 1 is reading requests, sorting them and drafting replies. Tier 2 is sending replies and booking vendor visits, approved by the office manager. Tier 3 is anything in the rent ledger. After a month, she sees she approved every "we got your request" reply unchanged, so she moves that one reply type to tier 1, in writing. Everything else stays put.

If you run several agents that hand work to each other, our note on multi-agent AI workflows covers where the handoffs and checks go.