The AI approval matrix: what AI can do alone, and what needs sign-off

A one-page control that decides, for every AI action, whether it runs on its own, needs a human's approval, or stays with a human entirely.

An approval matrix is the simplest governance tool an SMB can adopt. It answers one question for every action an AI can take: who has to say yes?

A starting template

Action	Low risk	Medium risk	High risk
Reply to a customer	Hours, directions: AI alone	Billing questions: human approves	Complaints, disputes: human decides
Spend or commit money	Under $250: AI alone	$250–$2,500: manager approves	Over $2,500: owner decides
Change a record	Add a note: AI alone	Update a status: human approves	Delete or refund: human decides

Set your own thresholds — the point is that they're written down before the AI goes live.

List every action the workflow can take.
Assign each a risk tier and an approver.
Build the rules into the workflow itself, not a policy document nobody reads.
Review the matrix monthly. Loosen it only when the data supports it (see Earned Autonomy).