What can an AI agent do without asking? Set approval levels by action

Start with the action, not the assistant's name

An assistant can be useful at drafting an email and still be unsuitable for sending it without review. A good summary does not prove it can safely change the CRM, approve a refund or publish a price. List each action the workflow might take. For each, record the affected people, sensitivity of the data, cost of an error, reversibility and evidence needed before acting. Australian AI-adoption guidance emphasises accountable governance and human oversight; an action matrix makes those responsibilities practical.

Keep readingBuild a reviewable first workflow

Use four approval levels as a starting framework

This is an editorial planning framework, not a legal or industry certification. Adapt it to the actual workflow and risk.

A level should name its limits. “Update the next-contact date for these reviewed records” is more useful than “manage sales.” Define which fields, records and destinations are included.

• Observe: read only the approved information and report findings.
• Prepare: create a draft or proposed change in a reviewable location.
• Execute within limits: perform a defined low-impact action when stated conditions are met and the outcome can be checked.
• Explicit approval: wait for a responsible person's instruction for a specified action affecting customers, money, publication or sensitive records.

Worked example: following up a quote

An agent reads the enquiry and drafts a follow-up using the actual quote details. Drafting is allowed; sending is a separate action. The reviewer checks the recipient, quote version, expiry, tone and whether the customer has asked for no further contact. After testing, a business might allow a narrow internal reminder when a reviewed quote reaches a milestone. That does not automatically authorise customer messages, a revised price or a CRM status that claims the customer accepted. Each action needs its own boundary and confirmation.

Make approval concrete and current

Show the exact proposed message or field changes, the target record or audience and the information supporting it. Record who approved what and when. If the material content, recipient, price or destination changes, return to the relevant approval point. Keep external content from granting permission. A customer's attachment, a web page or another automated task cannot expand the owner's approved scope merely by saying an action is urgent or already authorised.

Pair the matrix with real permissions and receipts

OWASP's excessive-agency guidance recommends restricting the functions, permissions and autonomy available to an AI system. A connection with limited access helps enforce the written matrix. Review shared administrator accounts and broad tokens rather than relying on a prompt alone. For an allowed write, define the success evidence. A saved draft, an accepted API request and a publicly visible publication are different outcomes. When a write response is lost, preserve the attempt and reconcile its actual state before repeating the action.

Keep readingCheck privacy disclosures for automated decisions

Change the level after evidence, not enthusiasm

Run representative and failure-case tests before granting a new action. Start with shadow or draft-only use where appropriate, review the errors and decide whether the benefit justifies the remaining risk. Assign an owner to review the matrix when the workflow, connected account or service changes. Keep a fast way to stop future actions without deleting the history needed to investigate what already happened.