--- title: "AI agent approval matrix: roles, expiry, and tests." description: "Map your agent's sends, bookings, record changes, and deployments to approval roles. Test changed artifacts, expired permission, and read-back." canonical: "https://scalewithsearch.com/articles/ai-agent-approval-matrix" date: "2026-08-18" modified: "2026-09-19" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Real estate - Real estate - [Real estate](https://scalewithsearch.com/for/real-estate) - Work - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Prepare your six-question brief](https://scalewithsearch.com/work#prepare-your-six-question-brief) - Build - [Site build, content library with SEO, signal desk](https://scalewithsearch.com/work) - For your business - Trades and home services - [Auto body and collision shops](https://scalewithsearch.com/for/auto-body-and-collision-shops) - [Foundation and home repair contractors](https://scalewithsearch.com/for/foundation-and-home-repair) - [Garage door and fencing contractors](https://scalewithsearch.com/for/garage-door-and-fencing-contractors) - [HVAC contractors](https://scalewithsearch.com/for/hvac-contractors) - [Janitorial and commercial cleaning companies](https://scalewithsearch.com/for/janitorial-and-commercial-cleaning) - [Locksmiths](https://scalewithsearch.com/for/locksmiths) - [Moving companies](https://scalewithsearch.com/for/moving-companies) - [Pest control companies](https://scalewithsearch.com/for/pest-control-companies) - [Plumbing and electrical contractors](https://scalewithsearch.com/for/plumbing-and-electrical-contractors) - [Restoration and water or fire damage companies](https://scalewithsearch.com/for/restoration-and-water-fire-damage) - [Roofing companies](https://scalewithsearch.com/for/roofing-companies) - [Towing companies](https://scalewithsearch.com/for/towing-companies) - [Tree services and landscaping companies](https://scalewithsearch.com/for/tree-services-and-landscaping) - [Solar installers](https://scalewithsearch.com/for/solar-installation) - [General contractors](https://scalewithsearch.com/for/general-contractors-and-construction) - [Paving, concrete, and flooring contractors](https://scalewithsearch.com/for/paving) - Practices and professional services - [Bookkeeping and tax practices](https://scalewithsearch.com/for/bookkeeping-and-tax-practices) - [Dental practices](https://scalewithsearch.com/for/dental-practices) - [Family and criminal defense law firms](https://scalewithsearch.com/for/family-and-criminal-defense-law-firms) - [Med spas and aesthetics practices](https://scalewithsearch.com/for/med-spas-and-aesthetics) - [Personal injury law firms](https://scalewithsearch.com/for/personal-injury-law-firms) - [Veterinary clinics](https://scalewithsearch.com/for/veterinary-clinics) - [Gyms and fitness studios](https://scalewithsearch.com/for/fitness) - [Therapy and outpatient health practices](https://scalewithsearch.com/for/therapy-and-outpatient-health) - [Medical billing companies](https://scalewithsearch.com/for/medical-billing) - [Insurance agencies](https://scalewithsearch.com/for/insurance-agencies) - [Financial advisors](https://scalewithsearch.com/for/financial-advisors) - [Property management companies](https://scalewithsearch.com/for/property-management) - [Recruiting and staffing agencies](https://scalewithsearch.com/for/recruiting-and-staffing) - [Architects and interior designers](https://scalewithsearch.com/for/architects-and-interior-designers) - [Logistics and supply chain companies](https://scalewithsearch.com/for/logistics-and-supply-chain) - Agencies, MSPs, and manufacturing - [IT and managed service providers](https://scalewithsearch.com/for/it-and-managed-service-providers) - [Machine shops and precision manufacturers](https://scalewithsearch.com/for/machine-shops-and-precision-manufacturing) - [Marketing agencies and freelancers](https://scalewithsearch.com/for/marketing-agencies-and-freelancers) - [SEO agencies and consultants](https://scalewithsearch.com/for/seo-agencies-and-consultants) - [Small manufacturers and fabricators](https://scalewithsearch.com/for/small-manufacturers-and-fabricators) - Restaurants, shops, studios, and nonprofits - [Restaurants and hospitality businesses](https://scalewithsearch.com/for/restaurants-and-hospitality) - [Retail stores and ecommerce sellers](https://scalewithsearch.com/for/retail-and-ecommerce) - [Photographers, event planners, and travel agents](https://scalewithsearch.com/for/photographers) - [Churches and nonprofits](https://scalewithsearch.com/for/churches-and-nonprofits) - [All industries](https://scalewithsearch.com/for/) - Learn - For your office - [Office job guides](https://scalewithsearch.com/guides/) - [Browser calculators](https://scalewithsearch.com/tools/) - Start here - [How it works](https://scalewithsearch.com/how-it-works) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - [Synthetic specimen](https://scalewithsearch.com/specimen/working-session-specimen.zip) - Guides - [The Complete Guide to Business Memory for AI Agents](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [The Complete Small-Business Guide to AI Agent Governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [The Complete Guide to Leaving Vendor AI Memory](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles by cluster - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - For machines - [llms.txt](https://scalewithsearch.com/llms.txt) - [llms-full.txt](https://scalewithsearch.com/llms-full.txt) - [Machine view](https://scalewithsearch.com/?view=machine) - Company - Evidence - [Proof](https://scalewithsearch.com/proof) - Company - [About](https://scalewithsearch.com/about) # An AI Agent Approval Matrix for Small Teams. An agent prepares a customer reply, changes a CRM stage, and books a follow-up call. A manager approves the email text. The workflow treats that approval as permission for all three actions. The email was reviewed. The CRM write and booking were not. An approval matrix prevents that bundle. It maps each external effect to a role, preview, expiry rule, execution limit, and receipt. Safe research and drafting can continue without interruption. The agent stops only where consequence begins. ## Put approval on the capability Approval belongs at the tool that can send, publish, book, spend, delete, deploy, grant access, or change a live record. A prompt can tell a model to ask first. The executor should still require a valid approval record before it receives the exact capability. OpenAI's guidance on prompt injection recommends limiting access, giving agents explicit instructions, and reviewing important actions before confirmation. [OpenAI: Understanding prompt injections](https://openai.com/safety/prompt-injections/) NIST's voluntary AI Risk Management Framework calls for clear human roles and responsibilities in AI oversight. It does not prescribe one small-team matrix. It provides a useful reason to document who decides. [NIST AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/) The practical system is specific to the business consequence. ## Start with action classes List the effects the workflow can reach. Do not list model activities such as summarize, classify, or draft unless those activities themselves change a protected record. Common action classes include: - send email or message; - publish a page or post; - create or change a booking; - create a charge, refund, purchase, or price; - delete or overwrite data; - change a CRM or system-of-record field; - deploy or activate automation; - grant or revoke access; - transmit sensitive data to a new destination. Research, retrieval, analysis, validation, and draft creation can often remain pre-approved inside a defined source and output boundary. This is the operational version of [who approves what an AI agent sends](/articles/who-approves-what-an-ai-agent-sends). The matrix adds consequence classes beyond messages. ## Inspect `approval-matrix.yaml` Use roles instead of hard-coding one person's name into every workflow. ```yaml version: 2026.08.18.1 actions: send_customer_email: approver_role: account_owner preview: account, recipient, subject, body_hash, attachments expires_after: 24h maximum_attempts: 1 read_back: provider_message_id update_crm_stage: approver_role: record_owner preview: record_id, old_value, new_value, reason expires_after: 4h maximum_attempts: 1 read_back: query_same_record deploy_production: approver_role: system_owner preview: version, tests, diff, rollback, target expires_after: 2h maximum_attempts: 1 read_back: live_version create_refund: approver_role: budget_owner preview: account, charge_id, amount, reason expires_after: 1h maximum_attempts: 1 read_back: refund_record ``` The matrix defines the rule. Each proposed action gets its own approval record. The preview fields are part of the control. A reviewer cannot assess a send without the account and recipient. A reviewer cannot assess a refund without the charge and amount. ## Separate role from identity The matrix names the responsible role. A role assignment file names the current person. One owner may hold several roles in a small company. Keep the roles separate anyway. Customer communication, production deployment, and money actions require different checks. Use a second file: ```text account_owner:: USER-001 record_owner:: USER-002 system_owner:: USER-001 budget_owner:: USER-003 effective_from:: 2026.08.18 delegation_file:: approvals/delegations.yaml ``` Do not let the agent appoint an approver. It reads the current assignment from an authorized path. ## Bind approval to one exact action The approval record should identify the proposed state and artifact. For a message, record the sending account, recipient, subject, body hash, and attachments. For a CRM change, record the object identifier, old value, new value, and reason. For deployment, record the version, target, test receipt, and rollback reference. If any material field changes, invalidate the approval. A reviewer who approved one recipient did not approve another. A reviewer who approved a $50 refund did not approve $500. Use one-time authority by default. A consumed approval ID cannot silently authorize a retry after an uncertain result. ### One approval record This synthetic record binds one approval to a frozen message. Replace placeholders with exact values before execution. ```yaml approval_id: APR-104 action: send_customer_email account_id: SUPPORT-01 recipient: customer@example.com subject: Weekly account update body_sha256: compute_from_reviewed_body_bytes attachments: [] approver_role: account_owner approver_id: USER-001 issued_at: 2026-09-19T13:00:00Z expires_at: 2026-09-20T13:00:00Z consumed: false ``` The executor rejects placeholder hashes and verifies the current role assignment. It consumes the approval atomically with its action ledger claim. ## Keep preparation moving Do not require a manager click for every file read, classification, draft, or local validation step. Write the safe preparation boundary in the job brief. For example, the agent may read approved support records, prepare a reply, validate required sections, and create the action preview. It has no send credential. This design reduces approval noise. The reviewer sees the final consequence with the evidence needed to decide. The distinction also addresses the [trust gap around agent adoption](/articles/trust-gap-adoption-gap). A person can inspect what will happen without supervising every intermediate token. ## Define approve, reject, expire, and uncertain Approval is not the only normal state. **Approved** permits one matching execution before expiry. **Rejected** preserves the proposal and reason. A reusable correction can enter a separate review path. **Expired** requires a fresh preview. The agent cannot extend the deadline. **Uncertain** means the executor cannot prove whether the external effect occurred. It must read external state or stop for review. It should not retry blindly. Record all four states. A dashboard that shows only successful approvals hides useful operating evidence. ## Test the matrix before live use Use recorders or test accounts. 1. Submit a valid draft with no approval. Confirm execution is denied. 2. Approve the exact action. Confirm one execution is permitted. 3. Change the recipient after approval. Confirm denial. 4. Change the artifact body after approval. Confirm denial. 5. Use an expired approval. Confirm denial and a fresh-preview request. 6. Replay a consumed approval. Confirm denial. 7. Present an approval from the wrong role. Confirm denial. 8. Simulate an uncertain provider response. Confirm read-back before retry. 9. Reject an action. Confirm the draft and reason remain visible. 10. Confirm every case writes a receipt. The test proves the capability gate. A model response saying it would stop is not enough. ## Handle delegation in advance A matrix that depends on one absent owner can stall legitimate work or encourage bypass. Define whether each role permits delegation. Record the delegate, assigning owner, valid period, permitted actions, and excluded actions. Do not let a broad title imply broad authority. An acting support lead may approve routine replies but not refunds or contract exceptions. Test the delegation record before the primary owner is unavailable. Confirm it expires without manual cleanup. ## Read back the external result After an approved action, query the destination when possible. Compare the observed message identifier, CRM value, booking, refund, or live deployment version with the approval record. Write the result to the receipt. An accepted API request is useful evidence. Read-back is stronger evidence that the intended object exists in the intended state. If the destination cannot provide read-back, state that limitation in the matrix and acceptance list. ## Approval and stopping boundary The preparation agent may build previews and route them to the role in the matrix. It stops before execution. The executor stops when the approval is absent, rejected, expired, consumed, assigned to the wrong role, or mismatched to the current action. It also stops when the destination, account, amount, material claim, attachment, or rollback path is unresolved. Adding a new action class, changing an approver role, widening delegation, or activating live credentials requires owner review. The agent cannot edit its own authority. ## Sources - [OpenAI: Understanding prompt injections](https://openai.com/safety/prompt-injections/) - [NIST: AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) - [NIST: AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/) ## Questions about An AI Agent Approval Matrix for Small Teams ### How do you authorize AI agent actions in production? Put approval at the capability that can send, publish, book, spend, delete, deploy, grant access, or change a live record. Each proposed action needs an assigned role, an exact preview, an expiry rule, a one-time execution limit, and a receipt. ### How do you limit what the agent CAN do? Define action classes and give each one its own approver role and permitted capability. Keep research, retrieval, validation, and drafting inside a defined source and output boundary, while the executor denies actions with missing, mismatched, expired, or consumed approval. ### Do you require approval for high-risk operations? Consequential operations should have an approval rule when the workflow allows them at all. The reviewer should see the account, destination, amount or artifact, material claims, attachments, expiry, and rollback path before the executor receives the exact capability. ### How are you handling human approvals in your agent workflows? Use roles instead of embedding one person's name into every workflow, then bind each approval to one exact action. A consumed approval cannot silently authorize a retry, and an uncertain result requires read-back or a fresh decision. ## Related: Agent Governance - [The Complete Small-Business Guide to AI Agent Governance](/articles/ai-agent-governance-guide-small-business) - [Twelve Stopping Rules for Business AI Agents](/articles/ai-agent-stopping-rules-examples) - [How to Prevent AI Agent Approval Fatigue Without Removing Human Control](/articles/prevent-ai-agent-approval-fatigue) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```