AI acceptable use and approvals: what AI may do alone
The hardest clause in an AI policy is the one about actions. A department-by-department table of what AI may do alone, what needs a person's approval and what it must never do.
Contents
Most AI policies say what staff may type into AI. Fewer say what AI may do. As agents begin to send email, update records and prepare payments, that second question has become the one that matters, and the answer belongs in a table.
Why the action clause is the hard one
An acceptable use clause for chat tools is mostly about data: which information may go in. An agent raises a different question, because its output is an action in a live system. The risk is no longer only a leaked document but an email sent to the wrong customer, a supplier record changed, a payment prepared to an account nobody checked. IBM's 2025 study found that 97% of organisations reporting AI-related breaches had no AI access controls1, which suggests that most companies have not yet translated intent into controls.
Three categories, one rule for each
| Category | Test | Typical examples |
|---|---|---|
| Always | Internal, reversible, low value; a mistake costs minutes | Drafting, summarising, filing, tagging, looking up records |
| Ask | External, financial, or changes a record others rely on | Sending external email, changing customer or supplier data, quotes, invoices, spending above a limit |
| Never | Irreversible, legally binding, or a decision about a person | Moving money, signing contracts, hiring and pay decisions, deleting records, changing its own permissions |
The table works only if each "Ask" action names its approver and each limit is a number. "Large orders need approval" invites argument; "orders over [amount] need the purchasing manager" does not.
A table by department
- Sales. Always: research a lead, draft a first reply, log a call. Ask: send a quote, change a price, promise a delivery date. Never: accept contract terms or give discounts beyond the price list.
- Customer service. Always: answer from the approved knowledge base, check order status, route tickets. Ask: issue a refund or credit, send a message about a complaint. Never: admit liability or change terms of service.
- Finance. Always: match invoices, prepare reconciliations, draft reminders. Ask: post journal entries, send a payment reminder that threatens collection, change a supplier's bank details. Never: release a payment.
- Purchasing. Always: check stock, draft orders below the limit, chase confirmations. Ask: place orders above [amount], change a supplier. Never: sign a framework agreement.
- HR. Always: answer policy questions from the handbook, schedule interviews. Ask: send an offer or rejection letter. Never: screen out candidates, decide pay, promotion or discipline.
- IT. Always: reset a password after verified identity, create tickets. Ask: grant access to a system. Never: grant administrator rights or change its own permissions.
What enforcement looks like in software
Approval rules can be enforced in three places, and they differ in strength.
- In the instruction to the AI. The weakest form: the rule is text the model is told to follow. It can be misread, and it leaves no independent record.
- In the data the AI can reach. Stronger: the AI cannot act on what it cannot see. Microsoft Purview, for example, can stop Microsoft 365 Copilot and agents summarising content with selected sensitivity labels2. On OpenLazarus, each AI sees only its own database3.
- In the system where the action happens. Strongest: the system holds the action until a person approves it and records both. On OpenLazarus, the company decides what runs automatically and what needs approval4. Its manufacturing page gives the example of a material order over $20,000, or a move of a promised ship date, waiting for a person, with every action logged where staff can see it5. Its financial-services page states that money never moves until a person releases it, that client messages showing performance wait for approval, and that a request to pay a bank account not on file must first pass a callback6.
The productivity suites handle the data side well; Google, for instance, lets admins switch Gemini features on for an organisational unit or group, and its audit logs track activity with Gemini7. What they do not provide is approval for an action an agent takes in another business system, which is why the comparison on our main page separates the two criteria.
A path to a working approval table
- List every agent and AI feature that can act, not only those that write text.
- For each, write the actions it takes today with the team that uses it.
- Sort each action with the test in the first table, and attach a named approver and a numeric limit to each "Ask".
- Configure the system so that "Ask" actions are held and "Never" actions are impossible, then test both.
- Review the log monthly for the first quarter. Actions that were always approved without change can move to "Always"; any surprise moves an action the other way.
Done well, the table becomes a living part of the policy: short, specific, owned by the teams that use the agents, and enforced by the systems rather than by memory. That is the difference between an AI policy that reads well and one that holds.
Questions buyers ask
What is an AI acceptable use policy?
The part of a company AI policy that says which AI tools staff may use, for what, with which data, and which actions AI may take on its own. Older acceptable use policies covered only chat tools; current ones also cover AI agents that act in company systems.
Which AI actions should always need human approval?
Anything external, financial, irreversible or affecting a person's record: sending external messages, changing customer or supplier records, issuing quotes or invoices, committing spending above a limit and changing commitments made to customers. Moving money, signing contracts and decisions about employees should not be delegated to AI at all.
How do you enforce AI approval rules?
In the software the AI acts in, not in the instructions given to it. The system should hold the action until a named person approves, and record both the action and the approval in a log that managers and compliance can review.
Sources
- IBM Report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls. IBM Newsroom, 30 Jul 2025. Accessed 8 Nov 2026.
- Learn about Data Security Posture Management for AI (classic). Microsoft Learn, 15 Dec 2025. Accessed 8 Nov 2026.
- OpenLazarus. OpenLazarus. Accessed 8 Nov 2026.
- Frequently asked questions. OpenLazarus. Accessed 8 Nov 2026.
- OpenLazarus for manufacturing. OpenLazarus. Accessed 8 Nov 2026.
- OpenLazarus for financial services. OpenLazarus. Accessed 8 Nov 2026.
- Generative AI in Google Workspace Privacy Hub. Google Workspace. Accessed 8 Nov 2026.
Updated 8 Nov 2026: First published.