Decide What AI Can Draft—and What a Person Must Approve

“A person checks it” sounds reassuring until you ask who, checks what, and before which action. An approval step needs those answers to be useful. Start with consequences. An internal summary and a customer refund promise should not pass through the same controls just because both are text.

Draw the first boundary For an early small-business workflow, allow preparation within a defined scope: draft summaries, proposed categories, and internal records. Require review for customer messages, quotes, and booking commitments. Keep payments, deletions, and permission changes outside the first version unless separately designed and authorized. Use the access checklist and FTC security guidance when deciding who can perform those actions. These are starting boundaries to adapt, not a universal policy for every business.

Show the reviewer enough evidence The review screen or packet should contain original input, proposed action, approved source, missing details, and the exact version being approved. For a customer reply, include the relevant approved FAQ answer. “Approve?” beside a polished paragraph encourages a quick click without a meaningful check.

Make approval specific to the version Fictional example: an estimator approves a quote at $850. Someone later edits the amount to $950. The first approval must not silently authorize the changed quote. Record what was approved, by whom, and when. If important content or facts change, require a fresh review. Google’s version-history guidance can help inspect document edits; it does not enforce this approval rule for your workflow.

Define reject and wait Rejection should return the item with a reason. An unavailable reviewer should leave it waiting or route it to an authorized backup—not turn a timeout into approval. Use the handoff process and name the backup in the maintenance card.

Test the approval boundary Try a rejected draft, an edited draft, changed underlying data, missing evidence, and an absent reviewer. Use the test log and OpenAI’s evaluation guidance for AI-related checks. The critical question is whether the external action remains blocked until the right review happens—not merely whether an approval button exists. Complete this sentence for one workflow: “___ reviews ___ using ___ before ___.” If you can name the person, evidence, and action, you have the beginning of a real control.