The approval gate · risky things never run before you approve

You don't need to worry about "what if AI just sends something on its own." Anything external or hard to undo goes through the approval gate. An employee builds it out to a draft and submits it for approval, and it only runs once you look it over and approve it.

Nothing happens before you approve. If you reject it, it goes back to the employee with your reason and comes back reworked.

Once you've approved enough requests at the same risk level and built up trust, you can turn on auto-approve for that level. Rejecting one resets trust back to zero.