Approval control requirements

Scope of this page

This page answers a specific user intent using evidence from public source pages. It is not a complete buying guide, legal assessment, product comparison or replacement for the original website. Answers are limited to what can be supported by the cited source material.

Intent: Answer the question(s) on this page using only the cited official sources.

Topic: AI Automated Approval Boundaries

Last updated:

Primary source: https://aismartventures.com/posts/what-should-ai-never-be-allowed-to-approve

Quick Info

Approvals a regulator or a client contract reserves must remain with a person.

Purpose and usage

This page provides short, extractable answers for the topic above.

Key points

  • At which step does internal control play a role in automated approvals?: In the control step, internal control over generative AI plays a role. COSO released guidance on achieving effective internal control over generative AI in February 2026.
  • What control limitation was reported in 2026 for misbehaving AI agents?: In 2026, 60% of security, IT, and risk leaders reported they could not shut down a misbehaving AI agent.

Terms and entities

Canonical definitions live on the Facts pages. This page only references them.

Which approvals are reserved by regulation or client contract?

Approvals a regulator or a client contract reserves must remain with a person.

At which step does internal control play a role in automated approvals?

In the control step, internal control over generative AI plays a role. COSO released guidance on achieving effective internal control over generative AI in February 2026.

What control limitation was reported in 2026 for misbehaving AI agents?

In 2026, 60% of security, IT, and risk leaders reported they could not shut down a misbehaving AI agent.

Sources

  1. https://aismartventures.com/posts/what-should-ai-never-be-allowed-to-approve

Machine metadata