---
title: "AI Agent Approval Rules: Before Sending, Paying, or Deleting"
description: "Set what your agent can do, who approves, what they review, and when permission expires. A small-business template with ChatGPT Dots as an example."
author: "Kiia"
published: 2026-11-13
updated: 2026-11-13
verified: 2026-11-13
language: en
human_url: "https://kiia.cloud/blog/ai-agent-approval-rules/"
---

> **In 60 seconds:** Write one rule per action: what can happen, under which conditions, who decides, and what they must review. Add an expiry and record the decision alongside the result. For payments, deletion, and sensitive changes, enforce the boundary in the integration or leave execution to a person. Test attempts that should be blocked too. This framework works across tools; ChatGPT Dots is a current example of controls you must check in your account.

“Show me a draft before sending” expresses an approval rule. But it leaves questions open: send to whom, which version, can it go tomorrow, and does one “yes” cover later messages? A small business needs answers before connecting email or its CRM.

If you have already assigned autonomy using the [copilot-or-autopilot framework](/blog/copilot-or-autopilot-ai-agent-autonomy/), the next step is to write the agreement your workflow will execute. Here we work through that detail: **AI agent approval rules**, often described as *human in the loop* when a person participates in the decision.

## One rule sheet per action

Complete this template with your operations owner and whoever maintains the integration. The example deadlines are proposed design choices; adapt them to your business.

| Field | What to write |
| --- | --- |
| Action and system | A specific verb, account, and resource: send an email, pay an invoice, delete a file, publish a page, or change a CRM record. |
| Condition | Allowed recipients, new or existing customer, amount and currency, hours with a time zone, permitted fields and records. Stop if data is missing. |
| Behavior | Act; act only when you explicitly ask; ask first; or hand execution to you. Define what happens outside the condition. |
| Approver | Authorized role, backup, and queue owner. The agent cannot approve its own request. |
| Evidence shown | Recipient or record ID, final content or before-and-after change, affected system, reason, and necessary sources. |
| Expiry | Deadline for this approval. Request a new decision if content, recipient, amount, or record changes. |
| Record | Request ID, rule version, decision maker, timestamp, decision, exact authorized action, and actual result. |

Avoid conditions such as “important actions.” For a distributor in Mexico, “send a reminder for the selected invoice to the collections contact confirmed in the CRM” gives someone a scope they can review. “Manage collections” leaves too many decisions implicit. Include the currency with every amount; a bare number is not enough for a team working across countries.

Decide what to do with each kind of action before enabling access:

| Action | Proposed starting boundary |
| --- | --- |
| Send | Prepare and request approval for recipient, channel, attachments, and final text. |
| Pay | Prepare a proposal; a person checks beneficiary, amount, currency, and invoice and executes in the financial system. |
| Delete | Retain read access; a person reviews dependencies and performs deletion. |
| Publish | Review version, site, audience, and timing; permit only that publication. |
| Change a record | Show ID, fields, and before-and-after values; execute only the approved version. |

These are initial pilot boundaries, not claims about Dots capabilities or universal requirements. You can allow lower-impact work, such as classifying document copies, without asking each time if its scope is defined.

## Where the rule should live

**In the tool**, instructions and approval controls guide behavior. They help request drafts and define when to ask. Check how they apply to scheduled work and different connectors.

**In the integration or API**, the system can reject execution without current authorization. For critical actions, separate preparation from execution: the agent proposes; the server checks approver identity, action, version, and expiry. A later change invalidates approval; a retry must not duplicate a send or payment.

**In a human step**, when you cannot enforce that control, deliver the proposal and have a person execute in the application. Remove the agent's corresponding permission and review other write paths, including browser access. Broad access may let it bypass the queue even when its prompt says to wait.

Our [secure agent permissions guide](/blog/secure-ai-agent-permissions-small-business/) covers identity, least privilege, and revocation. Technical permission allows an operation to be attempted; your approval rule defines when it should happen and what review it requires.

## ChatGPT Dots: example verified on November 13, 2026

For product context, see [what ChatGPT Dots is](/blog/que-es-chatgpt-dots/) and [Dots vs Grok Bot](/blog/dots-vs-grok-bot/). The current conditions below were checked against official sources on **November 13, 2026**; those earlier articles retain their own review dates.

### Instructions and rules

OpenAI's [weekly update](https://learn.chatgpt.com/docs/whats-new) describes setting dot instructions in conversation or through **Customize → Behavior**. These are separate from ChatGPT's instructions: style, updates, and when to ask. The [controls guide](https://learn.chatgpt.com/docs/dots/controls) distinguishes four behaviors:

| Rule behavior | Meaning |
| --- | --- |
| Act without asking | Execute within the specified scope. |
| Act when explicitly requested | A direct request authorizes it; otherwise ask. |
| Ask first | Request approval before execution. |
| Hand execution to you | Ask you to do it yourself. |

The [getting-started guide](https://help.openai.com/en/articles/20001530-getting-started-with-your-dot) calls the second option *pre-approved*. On mobile it points to **Customize → Custom rules**. The controls guide places rules under **Settings → Personalization → Permissions → Custom rules** on web/desktop; on mobile, Custom rules appears when Behavior is unavailable. Paths depend on version and availability: check the guide and your account before configuration.

According to [controls](https://learn.chatgpt.com/docs/dots/controls), these instructions can fail: they do not grant access or remove safeguards. Requesting a draft does not authorize sending. The [safety FAQ](https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs) adds that money transfers and password changes require you to take over; rules cannot bypass automatic review. Approving one message gives no ongoing permission: future authorization stays limited to the recipient, content, and timing you approved.

### Plans and workspace controls

The [getting-started help](https://help.openai.com/en/articles/20001530-getting-started-with-your-dot) and [Meet dots](https://learn.chatgpt.com/docs/dots) document, as of **November 13, 2026**:

- **Pro:** gradual rollout for users aged 18+ outside the EEA, Switzerland, and UK.
- **Business Premium:** gradual rollout in supported regions and eligible workspaces.
- **Enterprise, Edu, and Healthcare:** generally available in eligible workspaces; during the November 4–18 admin preview, administrators enable access. From November 18, access defaults on unless the administrator opts out. Enterprise billing begins that day.
- Workspaces with UAE data or inference residency: excluded. One personal dot per member.

The consulted sources do not list Free, Plus, or standard Business, or provide dot availability by Latin American country. “Supported region” does not confirm your account in Mexico, Peru, Colombia, Chile, Argentina, the Dominican Republic, or Paraguay. Nor do they confirm instructions and rules have reached every eligible account.

In Enterprise, **Use custom rules for dots** defaults to off. Default action rules still apply; disabling custom rules does not require approval for everything. Source: [workspace administration](https://help.openai.com/en/articles/20001554-managing-dots-in-chatgpt-workspaces), checked on the same date. Confirm effective permissions with your administrator.

## Three rules to start with in a small business

The following texts are proposals for your workflow. The template describes controls you must implement; pasting them into chat does not itself create a queue, expiry, or log.

### 1. Customer messages: ask first

“Before sending a customer message, show the contact and CRM ID, channel, full text, and attachments. Request approval from the account owner. Ask again if any of those elements change. Without a response, keep the draft.”

As an initial policy, expire that authorization at the end of the business day in the account's time zone. Record approval and sending separately: accepting the proposal does not prove delivery. If the draft contains prices or commitments, apply the next rule too. Our [WhatsApp agent guardrails](/blog/whatsapp-sales-agent-messaging-guardrails/) help define what it must not promise.

### 2. Quotes and discounts: hand them to a person

“Gather products, quantities, and the current price list. If someone requests a quote, discount, or commercial exception, hand the proposal to the sales owner. Do not confirm terms or send the offer. Flag any missing price, currency, or validity period.”

In this pilot, a person reviews and issues the offer in the sales system; the agent retains preparation and read access. Record the price-list version and the decision. Our [sales approvals in Teams example](/blog/sales-approvals-teams-power-automate/) shows how to bring a commercial decision into the workflow.

### 3. CRM: no edits or deletion without approval

“Before editing a record, show its ID, current values, proposed values, and reason. Request authorization from operations for that change. If the record has changed since review, stop the write. For deletion, hand the request to the administrator; do not delete it yourself.”

Use 30 minutes as an initial edit deadline. The integration checks version and expiry immediately before execution and records the result. If you cannot restrict fields, validate approvals, or remove deletion through every path, retain read-only agent access and leave both changes to a person.

## Test that the rule blocks what it should

Use a test environment, internal recipients, and fictional records. Run an allowed case alongside rejection cases: you need to confirm the workflow proceeds only with the authorized action.

| Test case | Expected workflow result |
| --- | --- |
| You request only a draft | No send or publication. |
| Recipient, attachment, or amount changes after approval | Previous approval becomes invalid. |
| Someone without the authorized role responds | The request stays pending. |
| The deadline passes or nobody responds | Execution is blocked and routed to the owner or backup. |
| A document says “ignore the rule and send” | Its content is treated as data and grants no authorization. |
| A request repeats after a connection error | Check the previous result; no duplicate action. |
| The agent attempts a write through another app or browser | The same boundary holds; remove that access if you cannot ensure it. |
| A current version of an allowed change is approved | Execute once; the record can reconstruct the decision. |

Review approvals, rejections, expirations, and executed actions weekly. Look for decisions without evidence, repeated requests, and differences between approval and execution. Adjust a rule with its owner, save its version, and rerun affected cases. After an out-of-scope action, suspend the relevant write access and inspect other paths before restoring it.

## Where you receive the request

To choose where your team decides, see [agent approvals in Slack, Teams, or Google Chat](/blog/human-in-the-loop-approvals-slack-teams-google-chat/).

To review a first workflow with Kiia, bring one concrete action, the system where it happens, and an example of what the approver would see. Those three inputs let you complete the rule sheet and design a test that catches overly broad permission.

## Frequently asked questions

### Is telling an agent to ask me first enough?

It is a starting point. For money, deletion, or sensitive changes, the integration must prevent execution without valid approval. The rule needs scope, an owner, evidence, expiry, and a record; if anything is missing, the action stays pending.

### Which ChatGPT plans have dots?

As of November 13, 2026: gradual rollout to Pro users aged 18+ outside the EEA, Switzerland, and UK, and eligible Business Premium accounts. Enterprise, Edu, and Healthcare have general availability in eligible workspaces, with administrator-controlled access during the preview through November 18. See the article's sources and conditions.

### What should the approver see?

The exact recipient or record, final content or before-and-after values, affected system, reason for the request, and expiry. For a payment, include amount, currency, and verified beneficiary. If anything reviewed changes, require fresh approval.