Human Review and Approval¶
Which work requires sign-off¶
Any work classified as high risk under task-classification-and-routing.md requires explicit human sign-off before being treated as final: company policy, security controls, privacy practices, legal claims, financial models used for decisions, food-safety guidance, medical/nutrition claims, destructive migrations, and public product claims. This mirrors the list of things an AI agent may never independently approve in docs/governance/decision-rights.md.
Moderate-risk work does not require sign-off before proceeding but should be reviewable — see planning-and-work-logs.md.
How review is requested and recorded¶
- With a remote/PR workflow (once one exists — see docs/governance/open-questions.md, OQ-005): open a pull request and request review from the human with decision rights over the content (see docs/governance/decision-rights.md). The PR review itself is the record of approval.
- Without a remote/PR workflow (the current state of this repository): record the approval
explicitly in the relevant work log (see
planning-and-work-logs.md) — who approved, what was approved, and
when — or as an explicit note in the chat/session transcript that authorized the change, plus a
corresponding update to the document's
statusandlast_reviewedfields.
AI cannot self-approve¶
An AI agent must never set status: approved on a document it authored or substantially edited,
and must never treat its own output as final for high-risk categories without a recorded human
approval as described above. This is not a matter of confidence in the output's quality — it is a
structural rule: approval authority belongs to the human roles defined in
docs/governance/decision-rights.md, full stop.
Explicit instruction as the human's own act¶
When a human with the appropriate role gives an AI agent an explicit, contemporaneous instruction to execute a specific action — naming the action, in that interactive session — the agent carrying it out is the human's own act, exercised through the agent as a tool. The agent is not independently approving anything in that case; it is executing what it was specifically told to do. The agent may still surface a confirmation prompt first if the action appears to conflict with its editing guidelines, but once the human confirms, the action proceeds as theirs.
This does not relax anything else in this document. In particular:
- The instruction must be specific to the action being taken, not a general license to proceed. "Go ahead and update the pricing page copy" authorizes that edit; it does not authorize the agent to later decide, on its own inference, that a different high-risk change is also covered.
- A standing instruction to work autonomously, a permission mode setting, or a prior approval of a different document or action does not carry over to a new high-risk decision. The agent must not infer authorization from precedent, convenience, or a general "you have my trust" framing — it must be given for the specific thing being done, in that session.
- The agent must never treat its own judgment that an action is "probably fine to proceed with" as equivalent to having received this kind of instruction. If no such explicit, specific, contemporaneous instruction exists for a high-risk action, the agent still needs human sign-off as described above before treating the work as final.
In short: explicit + specific + contemporaneous human instruction is sufficient authority for the agent to act as the human's tool. Inferred, generalized, or stale authority is not — the agent still needs to ask.