The approval ladder: deciding how much an AI team may do without asking

Abstract

Businesses that let AI agents act on their records must decide, every working day, which actions an agent may take alone, which need a person's approval, and how that line should move as the agent proves itself. The main governance frameworks require oversight proportionate to risk and leave the operating rules to each organisation. This paper proposes an approval ladder. It grades each agent action on two axes, what the action reaches and whether it can be reversed, assigns an approval level to each grade, and adds a modifier for actions that affect many records or were prompted by content from outside the business. Freedom widens only for reversible internal actions, and only on evidence drawn from the agent's own approved work, with the statistical strength of that evidence stated. The paper positions the ladder against the EU Artificial Intelligence Act as amended in 2026, the NIST AI Risk Management Framework, ISO/IEC 42001, Singapore's agentic AI governance framework, the OWASP guidance on excessive agency, India's AI Governance Guidelines and the Digital Personal Data Protection Act, 2023, and the research since 1978 on levels of automation and automation bias. It then grades the actions of one real product, MatruOS, against the ladder and reports where the product falls short.

Section 1The question

An AI agent differs from earlier business software in one respect that matters here: it chooses what to do next. A rule-based workflow does the same thing every time a condition is met. An agent reads a situation, chooses among actions and carries one out. That choice lets it handle cases nobody wrote a rule for, and it also lets it choose wrongly in ways nobody anticipated.

In a business system the actions are concrete: draft an invoice, post a purchase bill, record a payment, change a price, reorder stock, reply to a customer, send a payment reminder, update an employee record, delete a duplicate. Each has a different consequence if it is wrong. A wrong draft that a person reviews costs a minute. A reminder sent to a customer who has already paid costs goodwill. A wrongly recorded payment distorts the books until someone notices. A payment to the wrong account may never come back.

A single on-off switch for the whole agent is too blunt. If every change needs approval, the person approving becomes a bottleneck, and Section 4.7 estimates what that costs. If nothing needs approval, the business hands its money and reputation to a system that will make mistakes at some rate. The approval ladder answers the question action by action, consistently, and in a way that can change as evidence accumulates.

Section 2What the frameworks require, and what they leave open

2.1 The EU Artificial Intelligence Act

Regulation (EU) 2024/1689, the EU Artificial Intelligence Act, requires in Article 14 that high-risk AI systems be designed so that natural persons can oversee them effectively while in use. Article 14(4) requires providers to enable the people assigned to oversight, as appropriate and proportionate, to: (a) understand the system's capacities and limitations and monitor its operation; (b) remain aware of the tendency to over-rely on its output, which the Act calls automation bias; (c) interpret the output correctly; (d) decide not to use the output, or to disregard, override or reverse it; and (e) intervene in or interrupt the system through a stop procedure. Article 26(2) requires deployers to assign oversight to people with the necessary competence, training, authority and support.

Most agents that draft invoices or send payment reminders are not high-risk systems under the Act. Annex III lists some uses that business agents can drift into: under point 4, AI used for recruitment, for decisions on promotion or termination, and for allocating tasks based on individual behaviour or personal traits or characteristics; under point 5(b), AI used to evaluate the creditworthiness of natural persons. Article 6(3) excludes an Annex III system that performs only a narrow procedural or preparatory task, but the exclusion never applies where the system profiles natural persons. An agent that only prepares a draft for a person to decide may therefore still be high-risk if it profiles individual employees or customers.

The Act applies in phases. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the obligations for Annex III high-risk systems, which include the Article 14 design duties and the Article 26 deployer duties, to 2 December 2027, and the obligations for high-risk systems embedded in products under Annex I to 2 August 2028. Businesses should check the current consolidated text before relying on any other date.

Where the Act does not apply, Article 14 is still the clearest statement in law of what meaningful oversight requires, and Indian businesses that supply European customers meet its language in contracts and supplier questionnaires.

2.2 The NIST AI Risk Management Framework

The NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023) organises AI risk work into four functions: Govern, Map, Measure and Manage. Subcategory MAP 3.5 asks that processes for human oversight be defined, assessed and documented. GOVERN 3.2 asks that policies define roles and responsibilities for human-AI configurations and oversight. The Generative AI Profile (NIST AI 600-1, July 2024) adds risks specific to generative systems, including confabulated output and information integrity. The framework is voluntary and leaves thresholds to each organisation.

2.3 ISO/IEC 42001:2023

ISO/IEC 42001:2023 specifies requirements for an AI management system, against which an organisation can be certified. It requires the organisation to assess AI risks and impacts (clauses 6.1.2 to 6.1.4 and 8.2 to 8.4) and to choose controls from Annex A or beyond it. Where human approval sits is one of those choices; the standard does not prescribe it.

2.4 India's Digital Personal Data Protection Act, 2023

Where an agent processes personal data, the Digital Personal Data Protection Act, 2023 applies. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and most obligations, including those in Section 8, apply from 13 May 2027. In early 2026 MeitY consulted on shortening this period for some obligations, so check the current notification. Four provisions bear directly on agents.

Section 8(1)

the data fiduciary is responsible for processing undertaken by it or on its behalf by a data processor. A business cannot pass this responsibility to its AI vendor.

Section 8(3)

where personal data is likely to be used to make a decision that affects the person concerned, or is disclosed to another data fiduciary, the fiduciary must ensure its completeness, accuracy and consistency. A collections agent that marks an individual customer as a defaulter, or an HR agent that records a finding against an employee, is making such a decision.

Section 8(5)

reasonable security safeguards against personal data breaches. Item 1 of the Schedule provides for a penalty of up to ₹250 crore for failing to take them.

Sections 8(10), 11 and 13

the fiduciary must have a way to resolve grievances, and the data principal has the right to a summary of the processing and the right to have grievances redressed. A business can meet these only if it knows which decisions about a person an agent proposed and who approved them.

2.5 India AI Governance Guidelines, 2025

India has no statute specific to AI. The India AI Governance Guidelines, released by the Ministry of Electronics and Information Technology under the IndiaAI Mission on 5 November 2025, are not binding. Their "People First" principle calls for human-centred design and human oversight, which commentators read as a person in the loop at critical decision points, and they propose liability graded by the function a party performs, the level of risk and whether it exercised due diligence. A business that can show, for each consequential agent action, who approved it and on what information has the record that a due-diligence argument needs.

2.6 The common gap

Each of these asks for oversight that fits the risk, documented and assigned to competent people, and each leaves the business to decide what that means for each action. In practice organisations tend towards one of two failure modes: blanket approval that people stop reading, or broad autonomy granted on the strength of a vendor's presentation.

Section 3Related work and what this paper adds

3.1 Levels of automation

Sheridan and Verplank (1978), in a report on undersea teleoperators for the US Office of Naval Research, described ten levels from a computer that offers no help to one that acts alone and ignores the human. Parasuraman, Sheridan and Wickens (2000) proposed choosing the level separately for each stage of a task: acquiring information, analysing it, selecting a decision and implementing an action. They judged the choice first by its effect on human performance (workload, situation awareness, complacency and skill) and second by the reliability of the automation and the cost of a wrong decision or action. In their air traffic example they recommended keeping decision selection at a low level of automation for high-risk functions. The ladder carries that restriction over to the step at which an agent's choice takes effect on the business's records or reaches an outside party.

Shneiderman (2020, 2022) argued that high automation and high human control are not opposites, and that systems should be designed for both. Feng, McDonald and Zhang (2025) proposed levels of autonomy specific to AI agents, defined by the role the user plays at each level.

3.2 Risk matrices for human involvement

Singapore's Model AI Governance Framework (second edition, 2020) uses a matrix of the probability and severity of harm to choose between a human in the loop, over the loop or out of the loop. The Model AI Governance Framework for Agentic AI, launched by Singapore's Infocomm Media Development Authority on 22 January 2026 and updated in May 2026, asks organisations to define checkpoints at which an agent needs human approval, especially before sensitive actions, and to check whether those approvals are effective. The OWASP Top 10 for Large Language Model Applications (2025) lists excessive agency (LLM06) and prompt injection (LLM01) as leading risks, and recommends limiting an agent's functions and permissions and requiring human approval for high-impact actions.

3.3 What is new here

Grading human involvement by risk is established practice, and this paper does not claim it. It adds four things:

1. 1Reversibility as an axis separate from reach, with an operational test for business records (Section 4.2).
2. 2Freedom earned only for reversible internal work, with the statistical strength of the evidence stated in numbers (Section 6).
3. 3A modifier for scope and source, covering bulk actions and actions prompted by outside content (Section 4.5).
4. 4A mapping to India's DPDP Act and a grading of one product's real action list against the ladder, including where it falls short (Section 8 and the appendix).

Section 4Grading an action

4.1 Axis one: reach

Reach is how far the effect of an action travels.

Deleting records is graded on reversibility and sits in R2: a soft delete is V1 and a permanent one is V3.

4.2 Axis two: reversibility

Reversibility is how completely the effect can be undone. The test is operational.

Under this test every message that reaches an outside party is V3: a later apology does not remove the message from the customer's phone. A document whose legal effect is cancelled by a counter-document the other party also receives, such as a credit note or a purchase order cancellation, is V2; the message that carried it is graded separately as V3.

4.3 Combining the axes

The two axes are related, since wider reach tends to mean harder reversal, but they are not the same. Posting a purchase bill is R2 and V1. Sending a payment reminder is R3 and V3, even though its financial effect is nil. Grading on reach alone understates the risk of outward messages, and a money test misses it entirely.

4.4 Five approval levels

4.5 The default mapping

Cells marked n/a cannot occur. A read changes nothing, so it has nothing to reverse. A draft has no effect until something uses it, so it is always V0; the action that turns a draft into a record or a message is graded on its own. Anything that reaches an outside party is V3 by the test above. An action with money or legal effect always leaves at least a record.

• It affects more records than a limit the business sets, for example a price change across 5,000 items.
• Its money total exceeds a limit the business sets.
• It was prompted by content from outside the business, such as a supplier's email or a customer's chat, which could carry injected instructions.
• The agent has already made more than a set number of changes of that kind in the hour or the day.

A business can always tighten. It may hold any action at a lower level, block an action entirely or require approval for every change above a money amount. It may not loosen a fixed cell.

4.6 Making L2 work

L2 is where most consequential actions sit, and where oversight most often fails. Parasuraman and Manzey (2010), reviewing the evidence, found that people supervising reliable automation tend to monitor it less closely, especially when other tasks compete for their attention, which describes most finance teams at month end. The effect appears in experts as well as novices, and instructions to be careful do not remove it. A person approving hundreds of correct changes a day is at risk of approving the next one without reading it.

The ladder therefore treats the design of the approval step as part of the control, in line with Article 14(4)(a), (b) and (d):

Each held change explains itself

what will change, why the agent proposes it and what records it relied on.

Volume stays low,

because reversible internal work moves to L3 once earned, leaving at L2 the changes that deserve attention.

The unusual is marked

changes above a money amount, to a new party or outside the usual pattern.

A person can edit before approving,

instead of choosing between a flawed change and losing useful work.

A rejection carries a reason

the agent can learn from.

4.7 What approval costs: an illustrative example

Take a ceramic tile manufacturer whose AI team holds 120 changes a day for approval, and suppose a person spends 20 seconds on each. That is 40 minutes a day, or about 15 hours over 22 working days (17 hours over 26). Suppose 70 of the 120 are purchase bills posted to the books (R2, V1). If that category earns L3 and a person instead checks a 10 percent sample after the event, assumed to take the same 20 seconds each, the daily approval work falls to 57 changes, or about 19 minutes. These figures are illustrative; a business should time its own approvals for a week.

Section 5Personal data

Where an agent's action uses personal data to decide something about an individual, the ladder adds three requirements drawn from the DPDP Act.

Accuracy before the decision

Under Section 8(3) the data must be complete, accurate and consistent. An agent that proposes to put an individual customer on credit hold must show the ledger entries it relied on, so the person approving can check them. Such decisions stay at L2.

Minimum access

The agent should reach only the personal data its role needs. A collections agent needs customer contacts and ledgers; it does not need salary records. Role-based access is a control separate from approval.

A record of who decided

For each decision affecting an individual, the business should be able to show whether an agent proposed it, who approved it, when and on what data. That record serves the grievance duty in Section 8(10) and the data principal's rights under Sections 11 and 13.

Section 6Earning freedom

6.1 The rule

An agent gains freedom the way a new employee does: on the evidence of its own work, in a specific category, over a recent period. Evidence from a demonstration, a vendor's claims or another business says nothing about this agent doing this work here.

A category of R2 action with V0 or V1 may move from L2 to L3 when all of the following hold:

1. 1A minimum number of the agent's changes in that category were approved by a person without edits.
2. 2Those approvals fall within a recent window.
3. 3No change in the category was rejected in that window.
4. 4A person with authority accepts the step up.

An approval after an edit shows the output needed correcting, so it does not count. The share of held changes that needed editing, by category, is itself a useful measure of where the agent is weakest.

The category returns to L2 when a person reverses a change made at L3, or when the business changes the agent's instructions, tools or underlying model in a way that could change its behaviour. Freedom is earned separately for each category: an agent that has posted 300 purchase bills correctly has shown nothing about its judgement on stock adjustments.

6.2 How little a clean run proves

If no error has occurred in n independent cases, the one-sided 95 percent upper bound on the true error rate is 1 − 0.05^(1/n). Hanley and Lippman-Hand (1983) showed that this is close to 3 ÷ n, the "rule of three", once n is about 30 or more.

A threshold such as 10 prompts a person to consider a step up; the table shows how little it proves. This is why the ladder confines earned freedom to changes the business can correct alone, keeps a person on every fixed cell, and withdraws freedom on the first reversal. To show an error rate below 0.1 percent for an irreversible action would take about 3,000 clean, independent cases in a row, which few businesses will collect for any one category. Businesses with higher volumes should set higher thresholds.

Section 7Limits of the model

Section 8How MatruOS relates to the ladder

MatruOS is a business system in which AI members work alongside the people of a business, each member with a role, such as Accountant or Collections officer. This section describes the controls as built at the time of writing, graded from the product's code, and states where they differ from the ladder.

8.1 Two control systems

8.2 How the levels compare

8.3 Where the product falls short of the ladder

AI replies from the Inbox assistant go out without a person,

and neither the dial, the organisation rules nor the pause switch reaches them. The ladder fixes every outward message at L2.

Messages and payments with no area level set

With no area level set, which is the starting state, an AI member trusted for routine work can send messages, including follow-ups in its own words, and record payments without approval. Every "Runs on Auto" row in the appendix also runs unheld for such a member in that state. The ladder fixes every outward message and every payment at L2.

Loops on Auto, once opened

As built, the getting-paid loop on Auto would send reminders on invoices up to 45 days late, and the follow-up loop quote follow-ups up to 24 days old, without approval, and turning a loop to Auto would also set its area of the dial to Auto. These levels are not open yet; we have recorded the change needed before they open.

Some money and legal actions can run without a person

Raising an invoice, issuing a draft invoice, billing a chat order, issuing a credit note, setting a customer's credit against an invoice, recording one payment across several invoices, recording an advance, posting a bank statement line, posting a purchase bill and creating a purchase order can run without approval when their area is on Auto. Invoicing a delivered sales order belongs to no area and follows the AI member's own setting. The ladder fixes these at L2.

Freedom is set for a whole area or loop

An area or loop mixes actions of different grades.

Edited approvals count towards a step up

The ladder excludes them.

Partial reset only

As built, loops on Auto would drop back to Ask after repeated failures in a day, but not after a person reverses a change or after a change of model. The area dial has no automatic reset.

Partial scope modifier

As built, loops on Auto would limit the number of steps a day and the money per step. Neither system holds bulk changes by record count, or changes prompted by outside content, as a class.

The money limit reads single lines before tax and misses record-based actions,

as described in Section 8.1.

We have recorded these as product work. Until they are closed, a business that wants the ladder's protection should set every area to Ask me, set every AI member to ask before each change, keep the loops at Watch or Ask, and turn off the reply assistant's AI answers in the Inbox settings.

AI can make mistakes. The controls above limit what a mistake can reach before a person sees it, within the exceptions listed.

8.4 Method

The product was graded from its code at the release current on 31 October 2026 (commit fe49e480), and regulation was checked on the same date. The grading will be repeated on the live product before each new version of this paper.

Section 9Conclusion

The approval ladder grades each agent action by what it reaches and whether it can be undone, holds everything that reaches outside the business, moves money or cannot be corrected by the business alone, and lets reversible internal work earn freedom on clean approvals in that category, with a person accepting each step. A run of good results proves less than it appears to, and the table in Section 6.2 puts a number on how much less.

Appendix: MatruOS actions graded on the ladder

Graded from the product's code at commit fe49e480, 31 October 2026. Scheduled reminders before and after an invoice's due date are on from the start for most business types and go out without a person once a channel is connected. They are rules the business can change or switch off, and this grading covers AI actions only.

Sources

Checked 31 October 2026. Regulation is stated as at that date.

1. 1Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 6, 14 and 26 and Annex III, EUR-Lex
2. 2Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal, 24 July 2026, EUR-Lex. Summaries: White & Case; Mayer Brown, 30 July 2026
3. 3NIST AI 100-1, AI Risk Management Framework 1.0, January 2023: MAP 3.5 and GOVERN 3.2.
4. 4NIST AI 600-1, Generative Artificial Intelligence Profile, July 2024
5. 5ISO/IEC 42001:2023, Artificial intelligence: Management system
6. 6Digital Personal Data Protection Act, 2023 and Rules, 2025, MeitY: Sections 8(1), 8(3), 8(5), 8(10), 11, 13 and the Schedule.
7. 7India AI Governance Guidelines, Ministry of Electronics and Information Technology, IndiaAI Mission, 5 November 2025. IndiaAI; commentary, JSA
8. 8Personal Data Protection Commission and Infocomm Media Development Authority, Singapore (2020). Model Artificial Intelligence Governance Framework, second edition.
9. 9Infocomm Media Development Authority, Singapore (2026). Model AI Governance Framework for Agentic AI, updated May 2026
10. 10OWASP (2025). Top 10 for Large Language Model Applications: LLM01 Prompt Injection, LLM06 Excessive Agency
11. 11Sheridan, T. B. and Verplank, W. L. (1978). Human and computer control of undersea teleoperators. MIT Man-Machine Systems Laboratory, report for the Office of Naval Research.
12. 12Parasuraman, R., Sheridan, T. B. and Wickens, C. D. (2000). A model for types and levels of human interaction with automation. IEEE Transactions on Systems, Man, and Cybernetics, Part A, 30(3), 286–297. https://doi.org/10.1109/3468.844354
13. 13Parasuraman, R. and Manzey, D. H. (2010). Complacency and bias in human use of automation: an attentional integration. Human Factors, 52(3), 381–410.
14. 14Hanley, J. A. and Lippman-Hand, A. (1983). If nothing goes wrong, is everything all right? Interpreting zero numerators. JAMA, 249(13), 1743–1745.
15. 15Shneiderman, B. (2022). Human-Centered AI. Oxford University Press.
16. 16Feng, K. J. K., McDonald, D. W. and Zhang, A. X. (2025). Levels of autonomy for AI agents. arXiv:2506.12469.

Change log

• 1.4 (31 October 2026): Inbox reply assistant added; payout and purchase approval limits credited.
• 1.3 (31 October 2026): starting-state gaps for messages written by AI members, money limit detail, loop at Ask for answering customers.
• 1.2 (31 October 2026): product section rewritten after review of the code, adding the Auto mode loops and correcting the appendix.
• 1.1 (31 October 2026): EU AI Act dates updated for Regulation (EU) 2026/1744; grid rebuilt with an operational reversibility test; scope and source modifier added; related work, India AI Governance Guidelines and exact statistical bounds added; product section rewritten to state gaps; appendix added.
• 1.0 (October 2026): first version.