Human approval gates

Goal: design an AI workflow where risky action pauses for review instead of letting automation run loose.

Outcome

You should finish with an approval-state diagram, an audit log plan, and a list of actions that require human review.

Example AWS shape

  • Workflow orchestration: AWS Step Functions for explicit states.
  • Task execution: Lambda functions with scoped IAM permissions.
  • Events: EventBridge for routing review-needed events.
  • Logging: CloudWatch Logs for state transitions and decision records.
  • Storage: DynamoDB or S3 for approved test artifacts.

Approval gates to model

  • Outbound messages.
  • Public publishing.
  • Payment or checkout changes.
  • DNS, backend, or production changes.
  • Access to sensitive data.
  • Deleting, overwriting, or moving files.

Runbook steps

  1. Draw the workflow as draft, review, approved, executed, and logged.
  2. Write one example payload that should stop for review.
  3. Write one example payload that can proceed automatically.
  4. Design the log fields: request ID, actor, action, risk level, approval state, timestamp, and result.
  5. Explain how rollback would work if the approved action creates a problem.

Portfolio artifact

Create an approval-gate README and a workflow diagram. The point is to prove that you understand AI security is not only model safety. It is operational control.