Guardrails and approvals

What guardrails are

Guardrails are practical limits that decide what a worker can do, what it cannot do, and what must be escalated for review. They help keep useful automation from becoming hidden risk.

What approvals are

Approvals are human decision points. They should appear before high-impact actions such as production release, customer-visible changes, access changes, billing changes, data deletion, sensitive-data handling, or unclear business decisions.

Common approval gates

The exact approval gates depend on the customer and project, but common gates include scope approval, design approval, release approval, security approval, billing approval, model/provider approval, and data-handling approval.

How users should review a gate

A user should approve only when the request is clear, the evidence supports the claim, the risk is understandable, and the next step is acceptable for the business.

• What is being approved?
• What evidence supports it?
• What changes for users or customers?
• What can be undone?
• What risk remains?

Autonomy levels

Autonomy should increase only when the workflow is proven. New workers, sensitive workflows, regulated projects, external systems, and customer-visible work should start with stricter approvals.

What can go wrong

Approval problems usually come from unclear owners, missing evidence, broad permissions, or assuming an AI worker can make a business decision. Fix the approval rule before continuing.

Read next

Read Custom AI workers for role-level configuration, or Trust and security for enterprise control expectations.