Human review belongs after the AI action has produced an output and before that output is treated as approved or sent into a consequential next step. Automation can handle the sign-off request, but the decision about the work should remain with the designated human reviewer.
Where to place the review step
Published workflow guidance provides two complementary patterns:
- In an approval process: sign-off requests can be automated while people make the decisions.
- In a prompt-based flow: a human review step can be placed after the prompt action.
These patterns place review at the boundary between producing an output and deciding what should happen with it. Automating the request does not require automating the judgment.
A practical sequence is:
- The AI action produces a draft, recommendation, or other output.
- The workflow prepares a sign-off request.
- A person reviews the output and approves, rejects, or requests changes.
- The workflow follows the approved decision path.
The review does not need to duplicate every automated step. Its most useful position is where interpretation, authority, or judgment affects what happens next.
What the reader must still confirm
The cited guidance establishes possible workflow patterns, not a universal rule for every team. Before implementing a review step, the relevant team must confirm:
- The decision point: Identify the first point at which the AI output influences an approval, record, communication, or downstream action. Place review immediately before that point when incorrect judgment could affect the result.
- The review scope: Decide whether the reviewer is checking the AI output alone or also confirming the proposed next action.
- The reviewer’s authority: Confirm who can approve, reject, or return the work, and whether that responsibility matches internal roles.
- The failure path: Define what happens when the reviewer rejects the output or requests changes.
- The risk level: Give closer review to decisions that are difficult to reverse, affect other people, or rely on information the reviewer cannot readily verify.
- Applicable requirements: Verify any legal, policy, contractual, or internal-control obligations separately; the workflow examples do not establish those obligations.
The practical rule is straightforward: automate the request, place human review at the judgment boundary, and confirm the boundary, authority, and failure path for each workflow.