Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Who Approves High-Risk AI Agent Workflows?

The business owner already accountable for the workflow's outcomes approves it, within a risk tiering a governance body sets, and a named person inside the workflow approves each consequential action once it runs. Check that your organization can name both people for each high-risk agent workflow and that neither role has defaulted to the AI team.

A governance circle connects an accountable approver, a stack of workflow policies, and a second approval point.

The business owner already accountable for the workflow's outcomes approves it, within a risk tiering a governance body sets, and a named person inside the workflow approves each consequential action once it runs. Check that your organization can name both people for each high-risk agent workflow and that neither role has defaulted to the AI team. The question has two layers that are often collapsed into one: who decides that an agent may run a given workflow at all, and who approves the individual actions it prepares once the workflow is live. Organizations that hand both layers to a central AI function get an approver who does not own the outcome and a governance body asked to approve payments it has no standing to judge. The published frameworks point the other way. NIST's AI Risk Management Framework and ISO/IEC 42001 both treat the assignment of roles and accountability as the foundation of governance, and Gartner has warned that uniform governance across agents leads to failure. The design that follows distributes authority: the governance body sets the tiers and the rules, the business owner approves the workflow, and a named person approves each consequential action within it. This page sets out the layers, who holds each, how they apply to a single claims workflow, what the record must show, how to test the arrangement, and which claims a buyer should not accept.

Key findings

  • Gartner's May 2026 press release states that applying uniform governance across AI agents will lead to enterprise AI agent failure, which argues for governance differentiated by workflow and risk rather than a single central gate (Gartner, 2026).
  • The NIST AI Risk Management Framework's Govern function places roles, responsibilities and accountability for AI risk at the foundation of the framework (NIST, 2023).
  • ISO/IEC 42001 defines an AI management system in the pattern of other management system standards, in which leadership assigns organizational roles and responsibilities for the system's objectives (ISO, 2023).
  • Federal guidance for agency use of AI directs agencies to designate responsible officials and establish governance structures for AI (Office of Management and Budget, 2024).
  • FINRA's 2026 oversight report warns that agents "may take actions that exceed the user's actual or intended scope or authority," and that agent chains "may be difficult to reconstruct" (Debevoise & Plimpton, 2025).
  • Article 14 of the EU AI Act requires that overseers of high-risk systems be able to "disregard, override or reverse the output" and "interrupt the system," capabilities that must be assigned to identifiable people (EU AI Act, 2024).

Why are there two approval layers, and why does the distinction matter?

Approving a workflow and approving an action are different decisions made at different times by people with different knowledge. The workflow decision is made once, before deployment, and asks whether this task, with this agent, under these controls, is an acceptable risk for the organization. It needs someone who understands the business consequences of the task going wrong. The action decision is made many times, during operation, and asks whether this specific payment, submission or record change should commit. It needs someone close enough to the work to judge the case and accountable for the result.

Collapsing the layers produces two failures. When the central AI team approves workflows alone, the business owner who will answer for the outcome has not agreed to the risk. When a governance body is asked to approve actions, it either becomes a bottleneck or approves by reflex. The MIT Sloan explainer describes agents as systems that plan and act across multi-step tasks with reduced human direction, which is why the organization must decide in advance where human direction remains (MIT Sloan, 2026).

The frameworks support the separation. NIST's Govern function is about establishing roles and accountability as a precondition for everything else, not about a single approver (NIST, 2023). Gartner's warning against uniform governance is a warning against treating every agent workflow the same way regardless of its risk and owner (Gartner, 2026).

Who holds authority at each layer?

Layer Decision Who holds it What the frameworks say
Policy and tiering Which workflows count as high risk; what controls each tier requires; who may approve at each tier Governance body: risk, legal, security, compliance and business leadership NIST AI RMF Govern; ISO/IEC 42001 leadership and roles; federal guidance on governance bodies
Workflow approval Whether this agent may run this workflow at this tier with these controls The business owner accountable for the workflow's outcomes, with security and compliance sign-off at higher tiers ISO/IEC 42001 role assignment; FINRA's concern with scope of authority
Action approval Whether this payment, submission or record change commits A named person inside the workflow who holds that authority today EU AI Act Article 14 override and interrupt; OpenAI-style accountability for harms
Oversight and review Whether the workflow is performing within its tier; whether the record supports reconstruction Governance body, drawing on the record NIST AI RMF Manage; FINRA's concern with reconstruction

The governance body does not approve workflows one by one. It sets the tiers, specifies the controls each requires, and decides which roles may approve at each. Federal guidance on agency AI use follows this pattern, designating responsible officials and establishing governance structures rather than routing each decision to a committee (Office of Management and Budget, 2024). The business owner then approves the workflow against the tier's requirements, and the named person inside the workflow approves actions. ISO/IEC 42001, as a management system standard, expects leadership to assign roles and responsibilities, which is how the three roles become real people (ISO, 2023).

How does this apply to a single claims workflow?

Take a claims adjudication workflow in an insurance operation. The agent's task is to review property claims on a claims screen, which shows the claimant identifier, policy number, loss description, supporting photographs, adjuster's notes and a payment authorization field, and to prepare a settlement recommendation.

The governance body has already classified claims payment as a high-risk workflow, because it moves money to external parties on the basis of content the agent reads. The tier requires tokenized identifiers before the model sees the screen, a person holding payment authority approving every payment, a record of what the approver saw, and quarterly review. It names who may approve the workflow: the head of claims, with security and compliance sign-off.

The head of claims approves the workflow. That person understands what a wrong settlement costs and how the controls change the adjusters' work. The AI team built the workflow and advises, but will not answer for a mispaid claim, so it does not approve.

Once live, the agent reads each claim with the claimant and policy identifiers as tokens, assesses the loss against the policy, and prepares a settlement amount. The payment routes to the claims supervisor who holds payment authority for that line. The supervisor sees the same screen the agent saw, approves or adjusts, and the payment executes with the real payee details resolving only at the payment system. The record shows the agent's preparation, the supervisor's identity and decision, and the time. The governance body sees the quarterly counts: claims prepared, payments approved and declined, and whether any payment bypassed the supervisor. Three roles, three people, none of them the AI team. Platform approval mechanisms that route decisions to different stakeholders can carry the second layer's routing (Microsoft Learn, 2026).

What must the record show to each role?

Each role needs something different from the record. The action approver needs to see, at the moment of decision, the screen the agent worked from and the action it prepared, so that the approval is a judgment about the case rather than a reflex. The business owner needs, over time, the counts and the exceptions: how many actions the agent prepared, how many were approved, declined or adjusted, and whether any committed without approval. The governance body needs evidence that each high-risk workflow is operating within its tier and that the record supports reconstruction, which is the regulator's stated concern (Debevoise & Plimpton, 2025).

Two properties of the record make all three possible. First, every action is attributed: the agent identity that prepared it, the person who approved it and the time it committed, joined in one entry. Second, the screens are preserved as the agent saw them, with identifiers as tokens, so that reconstruction does not require, and the record does not become, another store of sensitive values. A governed workflow is one in which these properties hold for every run, not only the runs someone chose to log.

The EU AI Act's Article 14 adds a requirement that bears on the record indirectly: overseers must be able to override, reverse or interrupt the system (EU AI Act, 2024). Those capabilities have to be assigned to people, and the record should show when they were used. A workflow whose record cannot show who interrupted it has not met the article's intent even if the capability exists on paper.

How should an organization test its approval structure?

Begin with a naming exercise. For each agent workflow in production or pilot, write down three names: the person who approved the workflow, the person who approves its consequential actions, and the body that set the tier it runs under. If any of the three is the AI team, a vendor, or blank, the structure has a gap. If the same person fills all three, the layers have collapsed. This takes an hour per workflow.

Then test the tiering. Take the governance body's definition of high risk and apply it to every agent workflow, including the ones that were deployed informally. Workflows that move money, send data outside the organization, change records others rely on, or act on regulated information should land in the high tier. Gartner's point cuts both ways: a definition so broad that every workflow is high risk is as uniform as one that treats every workflow as low (Gartner, 2026).

Then test from the record. For one high-risk workflow, pull a month of actions and confirm that every consequential one names its approver, that the approver was the person the workflow approval designated, and that none committed without approval. Then reconstruct one action end to end and time it. A pilot run under a defined structure is the right place to do this, and guidance on how a governed pilot works treats the naming exercise and the record review as the pilot's deliverables rather than its paperwork. Where the same question is asked of consumer-facing agent platforms, the privacy concerns raised usually come down to the absence of any such structure.

What does a governed environment change?

In a governed environment, the second approval layer stops being a role on an org chart and becomes a step the workflow cannot skip: a named person sees the action and its target before it executes, and the record shows who that person was.

This class of control works at the rendered screen. Sensitive values on each screen are replaced with consistent tokens before any model reads them, so the agent completes the task on tokens rather than on the claimant's name, account or diagnosis. Real values resolve only at an approved destination at the moment of an approved action. A named person confirms what is tokenized for the workflow, and the same or another named person approves consequential actions such as payments, submissions and record changes. Every screen as the model saw it, every action and every approval is recorded and exported to the organization's own logging.

That changes what each approval layer can prove. The business owner who approved the workflow can show the policy that was applied to it, which answers the governance frameworks' requirement that roles and accountability be assigned to people rather than to the AI team (NIST, 2023). The in-workflow approver can show that the agent's actions did not exceed the authorized scope, which is the failure FINRA's 2026 report warns about and the one that is otherwise "difficult to reconstruct" (Debevoise & Plimpton, 2025). A buyer asking who approved a specific workflow, and what that approver saw, gets a record instead of a committee name.

The environment does not alter the application, the user's permissions or the model, and it does not decide who in the organization holds authority; it records the decision those people make.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. The design implements the second layer and produces the record the other two layers need. The agent works in a governed environment in the customer's cloud, under the user's existing permissions, which are left unchanged. Substitution happens at the render layer before any model reads the screen, so identifiers appear to the model as consistent tokens such as ACCT_001 or PATIENT_001 for the whole run, and real values resolve only at approved destinations at the moment of an approved action. A named person confirms the tokenization policy before the run and approves every payment, submission and record change, the arrangement the design calls Supervised Delegation; that person is whoever the organization's workflow approval designated, not a central queue. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM, which is where the business owner's counts and the governance body's reconstruction come from. The design is model agnostic and requires no per-application integration.

Deployments are in pilot. A pilot on the reader's own high-risk workflow would show, for this question, who approved each consequential action and what they saw, whether any action committed without the designated approver, and whether one action can be reconstructed end to end from the record. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on official guidance and standards (the NIST AI Risk Management Framework 1.0, 2023; the ISO/IEC 42001 summary page, 2023; OMB Memorandum M-24-10, March 2024; Article 14 of the EU AI Act as published on artificialintelligenceact.eu), a law firm summary by Debevoise & Plimpton of FINRA's 2026 Regulatory Oversight Report (December 2025), Gartner's press release on uniform governance across AI agents (May 2026), MIT Sloan's explainer on agentic AI (February 2026), and Microsoft documentation on multistage approvals in Copilot Studio agent flows (updated June 2026). All sources were read as of October 16, 2026. The three-layer structure of policy and tiering, workflow approval and action approval is this page's synthesis; the frameworks require that roles be assigned, not this assignment.

No hands-on testing of any product was performed. ISO/IEC 42001 is described from ISO's public summary, not from the standard's text. FINRA's report is described through the cited law firm summary. Vendor documentation is described from the pages reviewed, and "not described" means not described in those pages; vendor features change, and the page carries its date. Statements about RedactSure describe current design, with deployments in pilot. The claims screen and the adjudication workflow describe a record type and a task shape, not any organization.

Whether a given assignment of approval authority satisfies an organization's regulatory obligations, its board's expectations or the requirements of a management system certification is a determination for its counsel, its assessors and its own risk, security and compliance officers, not for a research page.

What the record shows

The frameworks agree on the principle and leave the assignment to the organization, which is where it belongs. NIST, ISO and federal guidance all make the assignment of roles and accountability the first act of governance, and the one analyst warning in the record is against making that assignment uniform. The regulator's concerns are about scope of authority and reconstruction, which are failures of the second layer and of the record. The design that follows separates the decisions: a governance body sets tiers and rules, the business owner who answers for the outcome approves the workflow, and a named person inside it approves each consequential action, with a record that serves all three. Supervised Delegation implements the third role and produces that record. The test is to name one high-risk agent workflow and ask: who approved this workflow, who approves its payments and record changes, who set the tier it runs under, and can any of those three be found in the record?

Frequently asked questions

Should the AI team approve high-risk agent workflows?

No. The AI team builds and advises, but it does not answer for the workflow's business outcomes and cannot judge whether a wrong settlement, a wrong filing or a wrong disclosure is an acceptable risk. The business owner accountable for the workflow approves it, against requirements a governance body has set for its risk tier, with security and compliance sign-off at higher tiers.

What is the difference between approving a workflow and approving an action?

Approving a workflow is a one-time decision, before deployment, that this agent may run this task at this risk tier under these controls. Approving an action is a repeated decision, during operation, that a specific payment, submission or record change may commit. The first belongs to the business owner within the governance body's rules. The second belongs to a named person inside the workflow who holds that authority today.

What does a governance body actually do in this structure?

It sets policy rather than approving individual workflows or actions. It defines which workflows count as high risk, specifies the controls each tier requires, decides which roles may approve at each tier, and reviews the record periodically to confirm workflows are operating within their tiers and can be reconstructed. Federal guidance on agency AI use follows the same pattern, designating responsible officials and establishing governance structures rather than routing each decision through a committee.

Why does Gartner warn against uniform governance?

Gartner's May 2026 press release states that applying uniform governance across AI agents will lead to enterprise AI agent failure. A single central gate treats a low-risk summarization agent and a payment-moving agent alike, which either slows the first to a halt or under-controls the second. Governance differentiated by workflow, with risk tiers and owners assigned per workflow, matches the control to the risk and puts the decision with the person who holds the accountability.

What should the record show for a high-risk workflow?

For each consequential action: the agent identity that prepared it, the screen it worked from with identifiers as tokens, the named person who approved it, their decision and the time of commit, joined in one entry. From that record the business owner can read counts and exceptions, and the governance body can reconstruct any action end to end, which is the regulator's stated concern. The record should also show when an overseer overrode or interrupted the workflow.

How do I check whether my organization has this structure?

For each agent workflow, write down three names: who approved the workflow, who approves its consequential actions, and which body set its risk tier. If any name is the AI team, a vendor or blank, there is a gap; if one person fills all three, the layers have collapsed. Then apply the governance body's definition of high risk to every workflow, including informal ones, and pull a month of record for one high-risk workflow to confirm every consequential action names its designated approver.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.