Full automation is not the goal. The goal is automating the parts that should be automatic and keeping a person where judgement or accountability genuinely belongs.
What needs approval
Four tests. If an action meets any of them, gate it.
Irreversible. Deleting, sending, publishing, paying. If undo does not exist, a human decides.
Externally visible. Anything a customer, partner or the public sees. Internal mistakes are embarrassing; external ones are permanent.
Expensive. Real money, or significant compute.
Security-relevant. Permission changes, credential rotation, access grants.
Actions failing all four — reading data, writing internal logs, updating a draft, moving a card on a board — should run unattended. Gating them costs attention and buys nothing.
Design the request properly
An approval step is only real if the person has what they need to judge. Compare:
The workflow wants to continue. Approve?
with:
Send refund confirmation To:
customer@example.comAmount: £240.00 to card ending 4471 Reason: duplicate charge on 14 March This email cannot be recalled and the refund cannot be reversed. [Approve] [Reject] [Edit first]
The second states the action, the target, the amount, the reasoning and the consequence. It can be judged in five seconds. The first can only be rubber-stamped.
Include: what will happen, to whom, with what data, why the workflow decided this, and what cannot be undone.
Give reject somewhere to go
An approval step needs three outcomes, not two: approve, reject, and edit then approve.
Edit is the one most systems omit and the one people want most. The draft is usually 90% right; the reviewer wants to change a sentence and send. Forcing a binary choice means either sending something imperfect or throwing away work.
And rejection must record why. Those reasons are the best data you have about where the automation is weak, and they are how you decide what to fix next.
Timeouts
Decide what happens when nobody responds. An approval that waits forever is a workflow silently stuck.
For consequential actions, fail closed — expire the request and notify. Never default to proceeding after a timeout on an irreversible action, because that turns an unanswered question into an unsupervised decision.
Moving the line
Start with more approval than you think you need. Log every decision. After a few weeks, look at what people always approve without changes — those are candidates for automation. What gets edited or rejected stays gated.
That is how you earn autonomy: with evidence, incrementally, and in the direction the data supports.