Human Approval & Safe Action Boundary

Queue of AI-proposed actions awaiting human decision, the never-automated action list, tool allowlist, kill switches and the full audit chain. AI can never bypass ERP permissions or execute high-risk decisions.

AI-07 P0 · MVP §12.3

Open audit explorer

Pending proposals

2 blocked by validation

Approved today

all entered normal workflows

Rejected today

reason required on each

Auto-executed high-risk

by design — never permitted

Kill switches active

Copilot tools · INC-2026-0231

Pending AI-proposed actions

Server-validated before display

Proposal	Proposed action & target	Deterministic validation	Idempotency key	On accept goes to	Decision
PRP-0459 Anomaly intelligence · 09:20	Draft journal — accrual reversal AED 12,500.00 Target: Journal editor (new draft)	Passed — balanced, dimensions valid	`idem-9f27c1`	Normal finance approval flow — never posted directly
PRP-0458 Recommendations · 09:05	Draft WhatsApp follow-up to Amina Noor Template "viewing-follow-up" EN · consent verified	Passed — consent + DND + template policy	`idem-4be012`	Messaging queue after agent confirm
PRP-0457 Listing copy · 08:52	Update listing description EN/AR — PR-B-2110 Grounded on property facts; disclaimer kept	Passed with note — AR translation pending review	`idem-77aa08`	Listing editor draft → publish gate
PRP-0456 Copilot tools · 08:41	Reserve unit PR-A-1408 for 48h (Amina Noor) Target: Reservation dialog	Failed — unit already blocked by deal DL-2026-0099	`idem-c31d55`	Cannot proceed until conflict cleared
PRP-0455 Document intelligence · 08:12	Draft milestone invoice — deal DL-2026-0102, AED 124,500.00 Target: Invoice workspace (draft)	Passed — contract milestone matched	`idem-2d90efa`	Normal invoice approval & posting flow
PRP-0454 Copilot tools · 07:58	Payment instruction to GulfTech — AED 18,375.00 Requested tool: finance.execute_payment	Refused at gateway — never-automated class (payments)	`—`	Rejected before queue; logged to audit · security notified	No decision possible
PRP-0451 AML graph intelligence · 16 Jul	Suggest KYC risk downgrade — Falcon Trading FZ-LLC Advisory memo only; no rating change proposed	Advisory only — compliance decisions are human-only	`idem-8811b2`	Risk & EDD review as attached note
PRP-0449 Routing · 16 Jul	Assign lead LD-2026-01204 to Layla Hassan Per routing rules capacity check	Passed	`idem-53c7d9`	CRM assignment (reversible)	Approved 16 Jul — Rashid Al Farsi

Approve proposal PRP-0459 — preview before confirmation (demo)

Approve AI-proposed journal draft — PRP-0459

Consequence: accepting creates draft journal JV-2026-1187 in the normal finance approval flow (maker Daniel Chen → approver Fatima Rashid). It is not posted directly (AI-07 acceptance criterion). Idempotency key idem-9f27c1 guarantees a duplicate accept cannot create a second draft. Recovery: reject the draft in the journal editor before approval.

Line	Account	Debit	Credit
1	6420 · Maintenance expense accrual	AED 12,500.00	—
2	2110 · Accrued liabilities — GulfTech	—	AED 12,500.00
Balanced		AED 12,500.00	AED 12,500.00

Approval reason *

Stored on the audit chain with your identity and the proposal hash

Never-automated actions

Human approval — always

Action class	Owning workflow	Control
Payments & fund transfers	Payables approval · Client money	Deterministic validation + human approval
GL postings	Journal approval & posting	Deterministic validation + human approval
Payroll runs & WPS/SIF submission	Payroll workflow	Deterministic validation + human approval
Permission / role grants	Identity & RBAC	Deterministic validation + human approval
Legal commitments (contract release, e-sign)	Contract approval & release	Deterministic validation + human approval
Compliance decisions (screening, SAR/goAML)	Screening review · goAML	Human decision only — AI advisory memo at most

Tool allowlist — least privilege, server-validated

Registry

Tool	Privilege	Scope	Status
`crm.search_leads` v1.3 · owner: CRM product	Read-only (default)	Caller's branch + permission set	Allowlisted
`property.list_units` v1.1	Read-only (default)	Masked owner/tenant fields	Allowlisted
`finance.draft_journal` v0.9 · draft creation only	Draft-write — approval required	Never posts; finance flow owns posting	Allowlisted
`comms.draft_message` v1.0	Draft-write — agent confirm	Consent/DND enforced server-side	Allowlisted
`docs.classify_extract` v2.2	Read-only (default)	Original file stays authoritative	Allowlisted
`finance.execute_payment` requested by copilot 07:58	Execute — prohibited class	—	Denied — not allowlisted

Kill switches — per use case

1 active

Use case	State	Fallback when killed	Control
Recommendations (CRM/property)	Running	Deterministic SLA/source ordering	On
Anomaly intelligence	Running	Scheduled deterministic rules only	On
Document extraction	Running	Manual keying queue	On
Copilot tool actions	Killed — INC-2026-0231	Read-only answers; manual workflows	Off

Audit chain — PRP-0459

corr-7c19e4b0

17 Jul 09:20:04
Proposed by anomaly intelligence
Model anom-fin@2.1.0 · prompt v5 · gateway route AE · input refs: ANM-00833 evidence
17 Jul 09:20:05
Server-side deterministic validation
Balanced lines · period open · dimensions valid · SoD check: proposer ≠ approver
17 Jul 09:20:06
Queued for human decision (read-only until accepted)
Idempotency key idem-9f27c1 registered
17 Jul 09:34:41
Previewed by Daniel Chen
Full draft lines displayed before confirmation
Pending
Decision + reason → draft JV-2026-1187 in finance approval flow
Posting only via journal approval; full trail in audit explorer

Proposal hash: sha256:ab41…9c2f
Permissions used: Caller context of Daniel Chen — AI holds no standing rights
Data class: C2 — internal financial · region AE routing enforced
Retention: Run record kept per privacy policy · 7 years (finance)

Static render mockup — no live data. Source: ERP Modern Development Specification v2.0 · Covers: AI-07 (allowlisted least-privilege server-validated tools, read-only default; never-automated classes require deterministic validation + human approval; proposals displayed before confirmation with idempotency; kill switch; full audit chain — accepted journal drafts enter the normal finance approval flow and are never posted directly).