Practical guide

Where human approval belongs in an AI business workflow

Decide which AI actions can run automatically and which need review. Use a consequence-based matrix, a clear approval packet and a rule for changed drafts.

Colleagues reviewing work together at a table
Illustrative photograph: Campaign Creators / Unsplash.

“A person checks it” sounds reassuring until nobody knows who that person is or what they should check. Put approval at the decision that changes something meaningful, and give the reviewer enough context to make that decision.

Sort actions by consequence and recovery

The following matrix is an original planning tool, not a legal or industry standard. Assess your own context. A summary used privately has a different consequence from the same summary sent to a customer.

ActionSuggested starting control
Organise non-sensitive internal textSample-check accuracy and retain the original
Create a draft taskValidate fields and make errors visible
Change a public pageReview a rendered preview and recovery method
Send a quote or promise a deadlineNamed approval of the exact message and terms
Delete records or expand accessSeparate explicit decision; avoid routine automatic execution

Consider likelihood of error, impact, visibility and reversibility together. Do not use the table to waive controls required by your organisation.

Open planner with written task notes
Illustrative stock photograph, not evidence of our project: Estée Janssens / Unsplash.

Give the reviewer an approval packet

Include the proposed output, target, supporting source and unresolved assumptions. For a quote, show the approved price source, scope, recipient and expiry. For a page edit, show the before-and-after text and a preview. Long activity logs can be available separately; the reviewer first needs the decision.

Approve: [exact action]. Target: [page or recipient]. Version: [draft ID]. Evidence: [source]. Unresolved: [questions]. After approval: [what runs]. If rejected or expired: [what happens].

A button labelled Approve should authorise this packet, not a later changed version. If the price, recipient or scope changes, return the draft for another decision. Record the approved version and approver.

Put review before the consequence: Describe the action; Assess recovery; Show the reviewer; Approve the specific action
Put review before the consequence
Original illustrative guide: Set It Once. A vague promise that someone checks it is not an approval process.
Read the text version
  1. Describe the action. What will change, and for whom?
  2. Assess recovery. Can the change be reversed?
  3. Show the reviewer. Provide source, proposed output and risk.
  4. Approve the specific action. Record the decision before execution.

Plan for no answer

An unattended approval queue can become a hidden backlog. Set a review deadline, a backup owner and an escalation route. Silence should keep the action pending where approval is required. It should not gradually turn into permission.

In an illustrative support workflow, AI prepares a reply and highlights missing details. A person confirms the facts and sends it. If the review expires, the task moves to the backup owner while the customer message remains unsent. This is a proposed process, not an existing Set It Once integration.

Check the gate with a changed draft

Test an approved draft, a rejected draft, an expired request and a draft edited after approval. The fourth case is easy to miss. Confirm that only the exact approved version can proceed, and that retries cannot send it twice.

Start with one action and measure review time and corrections. If the queue is too slow, improve the packet or routing before removing the gate.

Choose approval points by the action’s consequence

In a hypothetical quotation workflow, AI can extract a public enquiry and prepare a draft. A person approves the exact recipient, scope and terms before sending. Another approval is needed if the draft later changes materially. By contrast, sorting a non-sensitive internal list may need sampling rather than an approval click for every row. Treat the boundary as a decision about impact and recovery, not a blanket rule that all AI activity needs the same friction.

Ask four questions: who can be affected, how will an error be discovered, can the effect be reversed, and what authority is required? A reversible internal label differs from a public price promise even when both are technically simple writes. Record the reason for each gate so that a future maintainer understands why it exists.

Prevent approval from becoming detached from the draft

Bind the decision to an identifiable version of the proposed action. In an illustrative quote packet, version Q-7 includes recipient, service scope, amount, currency and validity. If the recipient or amount changes, Q-7’s approval must not silently apply to Q-8. The implementation needs to check that the version being executed is still the version approved.

Show reviewers a concise difference from the previous version, the authoritative source and unresolved assumptions. Avoid a prominent approval button above an unreadable wall of logs. Provide a reject or request-changes path, and distinguish “approved to prepare” from “approved to send”. The business owner should be able to explain exactly what clicking the control permits.

Measure review capacity before removing a gate

Suppose an illustrative team receives 40 draft requests per day and each review takes three minutes. That is two hours of review work before corrections and exceptions. If capacity is only one hour, the queue will grow. Improve the brief, source quality, batching or staffing before concluding that approval itself is unnecessary.

Track waiting time, active review time, changed drafts and repeated errors separately. Repeated corrections to a price suggest a source problem; repeated uncertainty about scope suggests a brief problem. Remove or simplify a control only after reassessing its consequence and actual evidence, with a named decision owner. A quieter queue can otherwise hide an uncontrolled action rather than a better process.

Take one practical next step

If this is a problem in your team, explore AI consultation. Describe one task, the software you use and the result you need. Scope and terms are agreed before work begins.

Quick answers

Frequently asked questions

Should every AI output need approval?

Choose controls according to consequence and your organisation's requirements. Low-impact internal drafts may use validation and sampling; meaningful external actions need clearer decisions.

Can approval expire?

Yes, if you define that rule. An expired approval request should follow the agreed escalation path rather than release the action automatically.

What happens when an approved draft changes?

Treat material changes as a new version and request approval of that version before execution.

Martin Iliev, founder of Set It Once

About the author

Martin builds Set It Once to help people spend less time on repeated work. His guides explain what you can try, how to check the result and where the limits are.

More about Martin

All articles

Privacy & cookie notice

Privacy & cookies

Updated 5 October 2026. This notice covers the public Set It Once marketing website and its enquiry form.

Who is responsible?

Martin Iliev operates Set It Once and is responsible for the personal data collected through this website. For privacy questions or to exercise your rights, email miliev@setitonce.com or use the contact form. You do not need to provide a website address for a privacy request.

What we collect and why

When you send an enquiry, we receive your name, email address, optional website address and message. We use these to respond and take steps towards a possible service agreement at your request (GDPR Article 6(1)(b)). Security and abuse prevention rely on our legitimate interest in protecting the website (Article 6(1)(f)). The form temporarily uses a keyed hash of your IP address to limit repeated submissions for 60 seconds. Hosting infrastructure processes connection information such as IP addresses and requested URLs to deliver and protect the site.

There is no marketing subscription, sale of enquiry data or automated decision-making about you. Do not send passwords, API keys or sensitive client information.

Who can access the information?

Enquiries are stored in the private WordPress administration area and accessed by authorised administrators. Namecheap provides our website and email hosting and processes data to operate these services. Email addressed to miliev@setitonce.com is also forwarded to a Gmail account operated by Google so Martin can receive and handle correspondence. Their privacy notices explain their processing: Namecheap and Google. External links such as LinkedIn load only when you follow them; those websites have their own privacy notices.

International processing

Namecheap and Google may process information outside your country, including in the United States. Namecheap describes the contractual safeguards for covered services in its Data Processing Addendum. Google describes processing locations and safeguards in its Privacy Policy. Contact us if you need details about the processing of your enquiry.

How long we keep information

We retain enquiries while handling the request and necessary follow-up. We review enquiries after six months and remove closed enquiries that are no longer needed. Records required for an active service, a legal obligation or a legal claim may be retained for that purpose. This review covers WordPress records and related email copies; it is a manual review, not automatic deletion. Hosting logs and backups have separate retention arrangements with the provider. You can ask us for information about your particular record or request deletion.

Your rights

You may request access, correction, erasure, restriction, objection and portability where applicable. You may withdraw optional browser-storage consent through Privacy settings without affecting earlier lawful processing. We normally respond to rights requests within one month; legal exceptions may apply. You may complain to your local supervisory authority, including the Bulgarian Commission for Personal Data Protection.

Cookies and browser storage

Google Analytics 4 is optional and loads only after your explicit consent. It measures page visits and basic engagement, using browser/device information and an online identifier. Google processes the network address to provide the service; GA4 does not log or store individual IP addresses. We do not enable advertising features, Google Signals or automatic form tracking. Page URLs and referrers sent by this website exclude query strings and fragments; form contents are not sent. No third-party geolocation service is used. Fonts and images are hosted on this website. Necessary WordPress authentication and security cookies may be used when you sign in. These are separate from optional analytics and currency memory.

LocalStorage is browser storage rather than a cookie; the same preference controls cover it. Automatic currency suggestion uses your browser time zone locally. It is approximate and is not sent to a geolocation provider. If browser storage is unavailable, your choices apply only to the current page.

Online payment processing is not active on this page. Payment-provider information and purchase terms will be added before checkout is enabled.