Where human approval belongs in an automation

Every automation has a point where someone asks, "should a person check this?" The common answer is to put an approval on everything, to be safe. That feels responsible. In practice it produces a queue that people learn to clear without reading, and a business that believes it has a control when it doesn't. A person belongs on a step for a specific reason, and the reason should be written down.

The cost of getting it wrong

Ask one question of each step: if this went wrong and nobody noticed for a week, what would it cost?

Some answers are small. A misfiled document gets found and moved. An enquiry sent to the wrong colleague gets forwarded. A summary that misses a point gets corrected in the next meeting. These steps can run on their own, with a log, and a person can sample the log now and then.

Other answers are not small. Money that leaves the account to the wrong place. A message sent to a client that should never have gone. A decision about a person that they would reasonably expect a human to make. Those steps get a person, and the automation's job becomes preparing everything so that person can decide quickly and well.

Most processes have one or two steps in the second group and several in the first. Paying a supplier invoice is a good example. Reading the invoice, matching it to an order and checking the totals are all preparation. Releasing the payment, and noticing that the supplier's bank details have changed, are the moments where a mistake is expensive. So the person sits there and nowhere else.

What a useful approval looks like

If people are going to approve things, make the decision easy to make properly.

• Show what will happen, in a sentence. "Pay this invoice from this supplier, for this amount, to the same account as last month" is something a person can check in seconds. A link to a dashboard is not.
• Show what changed. The useful information is usually the difference: new bank details, a total above the usual range, a first invoice from a new supplier.
• Do nothing by default. If nobody responds, the payment waits. An approval that goes ahead after a timeout is a notification with extra steps.
• Make rejecting as easy as approving, and ask for a short reason. Those reasons are how the rules improve.
• Send it to one named person, with a named deputy. "The finance team" approves nothing.

This is also where the volume matters. If someone receives forty approvals a day and thirty-nine are routine, they will stop reading by Wednesday. Narrow the rules so that only the cases worth a person's attention reach a person.

Record what was approved, and by whom

Every approval should leave a record: what the person was shown, what they decided, when, and anything they wrote. Keep it where the business keeps its other records, not inside a supplier's tool you might stop paying for.

The record protects the person as much as the business. When a question comes up months later, "you approved it" is unfair if nobody can see what they were shown. "You were shown this, at this time, and approved it" is a fair conversation.

The case for a person on everything

The strongest argument against all this is simple. AI tools make mistakes that are hard to predict, so surely every output should be checked by a person.

There's something to it, and in two places it wins outright. Decisions about people, such as who gets an interview, who gets credit or what care someone receives, should keep a person involved whatever the error rate looks like. Under UK GDPR, people have rights about decisions made solely by automated means that have legal or similarly significant effects on them. The Information Commissioner's Office publishes guidance on what that means in practice. The same goes for anything the business would be embarrassed to explain to a client.

For the rest, checking everything doesn't make the process safer. It makes it slower, and it trains people to stop looking. A clear rule about which steps need a person, applied consistently and reviewed, gives better protection than a blanket rule that nobody follows.

When to take an approval away

Approval steps should be reviewed like anything else. After a few months, look at the record for each one. Some steps will have been approved every time, on cases that all look alike, with nothing ever going wrong. Consider replacing those with a sample, where a person reviews a handful each week instead of every one.

Go the other way too. If a step without an approval produced a mistake that cost something, add one, write down why, and look again in three months. The goal is a person in the right places, with a record that shows why each one is there. That's part of what a good runbook covers, alongside how to tell the automation is working and how to switch it off.

Questions people ask

Should every AI output be checked by a person?

No. Check the outputs where a mistake would cost money, trust or a relationship, and decisions about people. Let the rest run with a log that someone samples. Checking everything trains people to approve without reading.

What makes an approval step work?

It shows what will happen and what changed in plain words, it does nothing until someone decides, it goes to a named person, and it records the decision. If people receive so many approvals that they stop reading, the rules need narrowing.

Does UK GDPR stop us automating decisions?

It restricts decisions made solely by automated means that have legal or similarly significant effects on people, such as some hiring or credit decisions. Keeping a person meaningfully involved is the usual answer. For your specific case, read the ICO's guidance or ask a solicitor.

How often should approval rules be reviewed?

Look at the record for each approval step every few months. Replace a step that is always approved with a sample, and add one where an unchecked step caused a costly mistake.