Human override remains clear after adoption when the organization can show where oversight applies and how human intervention affects the workflow. The NIST AI RMF says human-oversight processes should be defined, assessed, and documented. Separately, the approval documentation states that an approval action can start a flow and wait for approvers’ response before the run completes.
Check both the process and the workflow
An approval checkpoint is useful, but its label alone does not establish a complete override mechanism. The adopting organization should be able to answer two separate questions:
-
Is the oversight process documented?
The process record should identify when human oversight applies, which role is authorized to act, and what evidence shows that the process was assessed. This reflects the NIST AI RMF’s emphasis on defining, assessing, and documenting human-oversight processes. -
Does the workflow actually wait for a human response?
The cited approval documentation describes an action that starts the flow and waits for approvers’ response before completing the run. The configured workflow should therefore be tested to confirm that behavior rather than assuming it from the action name.
Do not treat approval as the whole override path
A workflow that waits for a response establishes a human-response checkpoint. It does not, by itself, define the full authority surrounding that response.
The cited passages do not provide organization-specific rules for the authorized role, permitted intervention, rejected responses, absent responses, record retention, or recovery from an incomplete run. The adopting team must confirm those points in its own approved process.
Before accepting the workflow, it should have a concise record showing:
- where human oversight applies;
- who is authorized to respond;
- what the workflow does while waiting;
- how the response changes or ends the run;
- what happens when no usable response arrives;
- where the decision is recorded; and
- whether later workflow or configuration changes affect the checkpoint.
The practical test is straightforward: an auditor should be able to connect the documented oversight process to the workflow’s actual waiting behavior without relying on an assumption that an approval action automatically represents full human override.