At stage four of enterprise AI adoption, an agent can change an organization-controlled record or send a message outside the organization—but neither action should depend on the model remembering an instruction. Put a human approval boundary at the system that performs each action, then keep records that let someone reconstruct what happened.
What changes at stage four?
A five-stage enterprise AI architecture moves through identity and gateway, data, agents, write and send, then governance. Stage four adds two kinds of action connector and the approval boundary around them. These are functional roles that can map to systems an organization already operates; the architecture does not require a particular product. See William Chiu’s stage-four overview and William Lab’s companion architecture.
As an Amazon Associate I earn from qualifying purchases.
- Write connectors change internal systems: for example, editing a file, pushing a branch, or creating a ticket-reply draft.
- Send connectors cause an outward action: for example, replying to a customer, publishing in a company channel, or emailing a supplier.
The distinction matters because the impact and recovery options differ. A reversible internal change may be recoverable from a prior version; an external message may already have reached its recipient. In both cases, content quality and authorization are separate questions: a well-written action still needs the right approval.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesShould an AI agent be allowed to write to a CRM or ticket system?
It can be, if the organization deliberately bounds the connector and can review and recover its changes. Define the connector’s authority in terms of the actual systems and objects it may change, rather than granting broad access and relying on the agent to stay within its intended use.
#1 Best Overall
- Name the systems and record types the connector can modify.
- Keep a diff or prior state that a person can use to restore a change.
- Attribute changes to an account issued for that workflow, so activity is not obscured under a shared or unrelated identity.
These controls make a write’s scope and aftermath inspectable. They do not turn approval into a substitute for limiting access: the connector should have only the permissions needed for its defined work.
How do you keep an AI agent from sending an unapproved email?
Require approval for the specific proposed send, not blanket advance permission for a broad class of messages. The approver should be able to inspect what will actually leave the organization and authorize that individual action.
Enforce the boundary where the action happens: for example, in the operating system, tool layer, or platform account permissions. A prompt saying “ask for approval” is only an instruction to the model. It can be misread or dropped, so it does not by itself establish that an unapproved send is impossible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For each send connector, identify its permitted channels and recipients, as well as the system control that blocks sending without approval. A useful test is to remove approval in a test account and check whether that named control refuses the send. The action must fail at the control—not merely produce a warning or rely on a person noticing a missing approval afterward.
What should an AI approval record capture?
A person reviewing records should be able to determine who or what acted, what action was taken, when it happened, and who approved it. Use a structured approver field rather than depending on a free-text note, and have the system that performs the action create the record.
Keep the approval evidence somewhere independent of the acting tool’s own account of events. This lets an auditor query the evidence without having to ask the agent what happened or trust the same tool whose action is under review. For writes, retain the diff or prior state alongside the action evidence so the change can be understood and, where appropriate, restored.
How can you test that an approval gate actually blocks an action?
- Choose one recent write and one recent send. Use the records alone to reconstruct who approved each action and when. The record should identify the action and approver in fields a person can interpret without asking the agent to explain it.
- Use a test account for a send that requires approval. Remove or withhold approval, attempt the action, and verify that an identifiable system control refuses it.
If reconstructing an event requires interpreting vague free text or interviewing the agent, the evidence is not readily auditable. If the send succeeds without approval, the boundary is documentation rather than an enforced control. These checks establish whether approval and evidence work for the tested paths; they do not prove that every connector or workflow is safe.
What belongs in stage four—and what comes later?
Stage four’s immediate work is reliable approval for writes and sends, plus evidence of the action and its approval. In the five-stage reference architecture, stage five adds policy and gates, an audit ledger, halt and budget caps, and cost and quality metrics. Those are later-stage capabilities in that architecture, not reasons to postpone enforcing a real approval boundary at stage four.
Project-specific policies can offer more detailed guidance. For example, Apache Magpie RFC-AI-0004 says in its maintainer context that externally visible state changes and outbound messages should be reviewed in their final rendered form before sending. That is guidance for that project, not a universal legal or industry standard. OpenAI’s Enterprise and Edu release notes also give a product-specific example: when an action needs approval, review it on screen; workspace controls and action restrictions continue to apply. That note should not be generalized to every enterprise AI system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
