Permissions, approvals, and audit trails
How scoped tools, human decision points, isolation, escalation, and review records shape controlled AI employee work.
An AI employee becomes operational when it can use company systems. That access creates a design responsibility: define which identity it uses, which records it can reach, which actions it can request, and which decisions still belong to a person.
Start with scoped tools
A tool should expose the smallest useful operation for the workflow. Reading an approved set of inventory fields is a narrower capability than unrestricted database access. Creating a draft for review carries a different risk than sending the final message.
Scope can be expressed through account permissions, connector configuration, record filters, allowed operations, and environment boundaries. The system should make that scope visible to the people approving the workflow.
Place approvals at consequential decisions
Approval design starts with consequences. A person may need to approve a price assumption, external message, policy interpretation, financial commitment, or change to a system of record. The workflow can prepare the evidence and draft while reserving authority for the named reviewer.
A useful approval request includes the proposed action, the facts supporting it, unresolved assumptions, and the effect of each choice. This gives the reviewer a decision package instead of another research task.
Design escalation as part of the procedure
Escalation handles uncertainty, missing data, conflicts, unavailable systems, and policy exceptions. Define who receives each kind of issue, how urgent work is marked, and what happens while the workflow waits. A clear waiting state prevents silent completion and silent abandonment.
Use isolation to contain impact
Isolation separates environments, clients, datasets, credentials, and tool sessions where the work requires it. The specific boundary depends on the workflow and its data. The design goal is to keep one task's access and state from leaking into another task's operating space.
Keep a reviewable trail
The work record should connect the request, sources, procedure version, tool activity, exceptions, approvals, output, and final status. Reviewers can then reconstruct the work and identify which layer needs correction when the result is challenged.
Review the whole chain
A permission review alone cannot show whether an approval arrived at the right time. An approval log alone cannot show whether the connector exposed too much data. Review the chain as one workflow: intake, context, procedure, access, decision, and record.