How should human approval work in AI-assisted workflows?
Human approval means a person reviews a model’s output before it takes effect. The approval step should match the consequence: one click for a low-risk suggestion, a review with evidence for a posting or a regulatory record.
An approval step that users click through without reading gives no control.
Table of Contents
Summarize with:
Key facts
- The weight of the approval step should match the consequence of the action.
- Low and reversible actions can be accepted or dismissed inline.
- High-consequence actions need appropriate review and authorisation records. Add an electronic signature where applicable rules or policy require it.
- Who approved, and when, has to be recorded.
- The same confirmation for every action trains users to click through.
Approval by consequence
| Consequence | Approval |
|---|---|
| Low and reversible | Accept or dismiss inline |
| Medium | Review with sources, then accept |
| High or regulated | Review and authorise; record the decision; sign where required |
Design implication
Why it matters
Approval records that an authorised person reviewed the output and accepted the action within their responsibilities. Responsibility for the system and process also remains with the relevant people and organisation. If the step is too light for the consequence, a person signs off on something they did not check. If it is too heavy for routine items, people stop reading and approve in bulk, which has the same effect.
How it shows up in the product
- Inline accept and dismiss controls for suggestions
- A review panel with sources for medium-consequence items
- Where a signature is required, a step that states what is being signed
- An approval history next to the record
Options and trade-offs
- Each extra review step keeps control and eats into the time saving that justified the AI feature. With less review, errors travel further before anyone sees them.
- Bulk approval for groups that share a cause saves repeated clicks. Without a preview of what will change, it moves the risk around.
Common mistakes
- The same confirmation for every action
- Approval without the information needed to judge
- No record of who approved
- Signature steps that do not say what is being signed
Related experience