An approval step is there for the mistakes you can’t take back, like a wrong quote sent to a client or a payment to the wrong account. The workflow prepares the work and shows it to a person before anything leaves the business, moves money or decides something about someone. Steps where a mistake is cheap and easy to undo can run on their own, once they’ve shown they get it right.
We build every workflow this way. As our how we work page puts it, anything that matters waits for a human OK.
A wrong answer from your automation is still your answer
In November 2022, Jake Moffatt asked the chatbot on Air Canada’s website about bereavement fares. The chatbot said the reduced fare could be claimed after travelling, which Air Canada’s policy didn’t allow. When Moffatt claimed the difference, the airline argued it wasn’t liable for what its chatbot said. The tribunal in British Columbia disagreed: “It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.” It ordered the airline to pay C$812.02 (Moffatt v. Air Canada, 2024 BCCRT 149, 14 February 2024).
The amount was small, but the reasoning applies to any business. You answer for what your automation sends in your name.
Two New York lawyers learned the same about text an AI writes. They filed court papers citing decisions that ChatGPT had invented, and the judge fined them and their firm $5,000. He saw “nothing inherently improper about using a reliable artificial intelligence tool for assistance”, but added that the rules “impose a gatekeeping role on attorneys to ensure the accuracy of their filings” (Mata v. Avianca, opinion and order on sanctions, 22 June 2023).
The companies that make AI models put this in their terms. OpenAI’s usage policies don’t allow “automation of high-stakes decisions in sensitive areas without human review”, such as in employment, credit, legal and medical matters. Anthropic’s usage policy requires a qualified person to review AI output on legal advice, credit or hiring before it goes out or is acted on. Both say so as of October 2026.
The common automation tools have the pause built in. n8n can hold an AI agent until someone approves an action, Zapier has a Human in the Loop step, and Microsoft’s Power Automate has a “Start and wait for an approval” action, with invoices and sales quotations among its examples.
Where the approval step sits, and what the approver sees
Take the weekly supplier order from our home page. Every Monday the workflow reads last week’s orders from the online shop and the till, compares stock with each product’s reorder level, and drafts one order per supplier. Then it stops. Maria gets the drafts, and only after she approves or edits them does the workflow send the orders and log them in the stock sheet.
The step sits right before the action that can’t be undone, such as sending an order or making a payment. Everything before it is preparation, so it can run unsupervised.
What Maria sees decides whether the check is real. A useful approval screen shows:
- The draft: the order exactly as the supplier will receive it.
- What it was built from: last week’s sales and current stock, so she can check a number without looking it up.
- What’s unusual: a quantity twice last month’s, a product ordered for the first time.
- Three choices: approve, edit or reject. If editing is slow, people approve things they’d rather have changed.
The middle two points matter most. The EU AI Act calls the risk “automation bias”, “the possible tendency of automatically relying or over-relying on the output” of a high-risk AI system (AI Act, Article 14). Europe’s data protection authorities say human oversight of an automated decision has to be “meaningful, rather than just a token gesture”, by someone with “the authority and competence to change the decision” (Article 29 Working Party guidelines on automated decision-making, page 21). An OK button under a wall of text invites the token gesture. The source and the flags give the approver something to check.
Each approval is logged with who approved what and when. That log later tells you whether a step is ready to run on its own.
Which of your workflows need a person to approve
A step needs a person when it does one of these:
| What the step does | Why a person checks it |
|---|---|
| Sends something outside the business: a reply to a client, a quote, an offer | Once sent, it can’t be taken back, and you answer for what it says |
| Moves money or sets a price: payments, refunds, invoices, discounts | A mistake costs money directly |
| Decides something about a person: a shortlist of job applicants, refusing a customer credit | The law can require a person (see below) |
| Can’t be undone: deleting records, cancelling a booking, an order a supplier will ship | There’s no undo once it has run |
| Was written by AI, and someone will read or rely on it | AI models can make things up, convincingly |
| Doesn’t fit the pattern: a case the workflow hasn’t seen before | It was built for normal cases; odd ones need judgement |
On our projects, when something unusual comes in, the workflow stops and asks a person.
For decisions about people, the law has a say. Under GDPR Article 22, a person has the right “not to be subject to a decision based solely on automated processing” that has legal effects on them or “similarly significantly affects” them. The regulation’s own examples are the “automatic refusal of an online credit application or e-recruiting practices without any human intervention” (GDPR, Article 22 and recital 71). Exceptions, such as explicit consent, come with safeguards, including the right to have a person look at the decision. A proposal to reword Article 22 is still waiting for a European Parliament committee vote as of October 2026 (procedure 2025/0360(COD)), so the current text applies.
The EU AI Act adds a rule for “high-risk” AI, which includes systems used to filter job applications or assess a person’s creditworthiness (Annex III). A business using such a system must “assign human oversight to natural persons who have the necessary competence, training and authority” (AI Act, Article 26). After the July 2026 amendment, that applies from 2 December 2027 (Regulation (EU) 2026/1744). Our post on the AI Act covers the rest for a small business. This isn’t legal advice. If a workflow of yours decides things about people, check it with a lawyer.
When a step can run on its own
Most steps in a workflow don’t need anyone: reading an email, copying an invoice’s details into a spreadsheet, sorting requests, updating your CRM. If one goes wrong, someone fixes it in a minute and nobody outside sees it.
For steps that start with an approval, our workflow automation page describes the path: the workflow “runs alongside your team for a while, then on its own.” A step is ready to drop its check when:
- A mistake would be cheap and easy to undo. If the worst case is a wrong row in a sheet, the check costs more than it saves.
- The approval log shows a track record. The person has approved what the workflow proposed, unchanged, for a good stretch at normal volume - a few weeks, say. If they keep editing, the step isn’t ready, and their edits show what to fix.
- Unusual cases still stop. The check can narrow instead of disappearing. In our restaurant example, booking replies go out on their own, but groups larger than 10 wait for Dan. A shop might let routine reorders through and hold any order above a set amount.
- Someone keeps looking. Every run is logged, someone still spot-checks a sample, and anything that looks off gets corrected and run again.
Some steps never get there, and shouldn’t. In our law firm example nothing goes out without the lawyer, and payments always wait for a person. For the rest, you decide step by step, from the log.
A check you can run on your own workflows
Pick one weekly process, write down its steps, and ask five questions about each:
- Does the result leave the business?
- Does it move money or change a price?
- Does it decide something about a person?
- If it were wrong, could you undo it within a few minutes?
- Did an AI write it or choose it?
A yes to 1, 2, 3 or 5, or a no to 4, means the step needs a person to approve it, at least until the log says otherwise. The rest can run on their own.
To see it mapped out, describe the process in the automation plan. You get the steps back, with what runs on its own and where a person signs off.
Want to talk it through?
Book a call, or tell us about one process in a few lines.