An AI-generated proposal may wait for a person while the underlying situation changes. A recipient is corrected, availability changes or a record is withdrawn. If approval is only a yes flag, the workflow can execute work the reviewer never saw. Make approval validity an explicit part of the agency brief.
Related service: AI automation development- 01Present the proposal
- 02Record a scoped decision
- 03Recheck current state
- 04Execute or request review
SECTION 01
Define the details the reviewer is approving
List the target, intended action and significant fields displayed at review. Identify which changes require another decision and which harmless presentation changes do not. The definition belongs to the business workflow, not to a generic timer applied to every action.
OWASP's transaction-authorization guidance connects approval to significant transaction data and server-side enforcement. That principle applies beyond payments: an approved message recipient or record update should not be swapped after review. Ask the agency to show how approval validity is checked even when the action is triggered by a background worker.
SECTION 02
Illustrative example: a delayed supplier message
An assistant drafts a supplier email summarizing a requested delivery change. A manager approves it, but sending is delayed by an outage. Before recovery, the order's delivery address changes. The original approval should not automatically authorize a newly regenerated email with different details.
The workflow compares the pending proposal with the relevant order version. It marks the approval as requiring recheck and presents the changed address to the manager. If the original approved message remains appropriate, an authorized person can make that decision explicitly. The system keeps both decisions so staff can explain why the send was paused.
SECTION 03
Test time, state and authority separately
Acceptance should include an expired approval, a changed recipient, revoked reviewer access and a record edited while the approval screen is open. Verify that repeated clicks cannot authorize several distinct actions. A clear status should distinguish awaiting review, approved, expired, invalidated and already executed.
OWASP's excessive-agency guidance supports human approval for sensitive operations, but approval only helps when reviewers see useful context. Ask for a handoff document covering validity rules, notification ownership and recovery after downtime. Longer validity reduces review interruptions; shorter validity reduces stale-context exposure. Choose the balance for the actual action rather than promising one universally safe interval.
SECTION 04
Frequently asked questions
Must every approval expire after the same period?
No. Base validity on the action and how quickly its context can change, then document the rule and review it with the business owner.
Can the AI refresh an approval automatically?
It can prepare a new proposal, but it should not impersonate the required human decision or inherit approval for materially changed work.
Does expiry undo an already completed action?
No. Expiry governs pending execution. Completed actions require their own correction or reversal process where one is possible.
PRIMARY REFERENCES
Sources and further reading
These references cover the standards, platforms, or published prices discussed in the guide. Worked examples and checklists are our editorial guidance.
EDITORIAL METHOD
About this guide
We use AI to assist with drafting and editing. Catapult AI Work is responsible for the published content. Examples illustrate possible approaches; they are not client case studies unless identified as such.
Budget examples are not Catapult package prices. Check linked provider pages for current fees and plan limits before making a purchase.
Read the editorial policy