When every decision reaches the same people
A company automates purchase, discount or contract requests, but keeps the approval logic used in email. Every item follows the same chain. Routine and unusual cases wait together, approvers receive incomplete information and the requester cannot see why the process stopped.
The problem is not a lack of notifications. It is the absence of an explicit decision model. Approval automation only improves the operation when the flow can distinguish routine eligibility checks, recommendations and formal authorization. Otherwise, the technology accelerates submission while preserving the bottleneck at the decision point.
Separate eligibility, recommendation and authorization
Eligibility answers whether the request satisfies objective prerequisites. A purchase request may need a valid cost center, an active supplier and a budget balance. These checks can usually be deterministic and should happen before any approver receives the item.
Recommendation organizes context for the decision. An agent can compare policy, history, attachments and similar cases, then highlight inconsistencies or missing evidence.
Authorization is the accountable act that releases a consequence, such as committing budget, granting a discount or changing a contract. The system must know who may authorize, within which scope and under which conditions. Combining the three stages in a single approve button hides both automation failures and the actual responsibility of the decision maker.
Build authority levels from consequences, not only value
Monetary thresholds are useful, but they are not enough. A low-value request may involve personal data, a strategic customer, a restricted supplier or an irreversible operational change. Define authority using a small set of factors such as amount, reversibility, regulatory exposure, contract deviation and service impact.
For each combination, document who can approve, whether a second review is required, which evidence is mandatory and what the system must do when data is uncertain. Keep the matrix versioned and assign a business owner. A rule without an owner tends to remain active after the policy or organization has changed.
NIST SP 800-53 describes separation of duties as identifying responsibilities that need to remain separate and defining access authorizations that support that separation. In practice, a person who creates or modifies a sensitive request should not silently become its only approver through a change in role or delegation.
Choose the approval pattern for the real risk
Not every flow needs the same pattern. First response works when any authorized member can make an equivalent decision. Everyone must approve is appropriate when independent responsibilities need to agree. Sequential approval is useful when a later reviewer depends on a previous decision, but it also adds waiting time at every stage.
Microsoft documents these different behaviors in Power Automate, including first response, all responses and sequential approvals. The important point is not the platform name. The workflow must express the organization's decision rule instead of choosing a convenient component and adapting governance to it.
Define deadlines, substitutes and expiration
Every approval needs a response target and an escalation rule. Specify when the clock starts, which business calendar applies and what happens near the deadline. Escalation may notify the approver, transfer the item to an authorized substitute or return it to the requester. It should not silently approve a sensitive request.
Delegation needs start and end dates and an equivalent authority scope. A substitute should not receive broader permissions than the original approver. An expired request may need new validation because price, budget or contract conditions may have changed.
Keep evidence that explains the decision
The approval record should preserve the request version, source data, applicable policy, authority rule, recommendation, decision, comments, identity and timestamp. If the request changes after approval, the system must evaluate whether the modification invalidates the previous decision.
OpenAI guidance recommends human intervention for sensitive, irreversible or high-stakes actions and when failure limits are exceeded. An agent can prepare the approval package and identify the route, but uncertain classifications, conflicting data and high-impact actions need a defined transfer to an authorized person.
A hypothetical example: B2B discount requests
Consider a hypothetical industrial software company, not an NM Solutions customer case. Sales representatives request discounts for contract renewals. The old process sends every request to the commercial director, even when the discount is already allowed by the customer's segment and the standard margin policy.
The new flow first checks customer status, product, contract term, margin and mandatory attachments. Requests within the documented range and with complete data can follow a simplified authorization by the sales manager. Deviations that reduce margin below the threshold go to finance and the commercial director. Terms outside the standard contract also involve legal review.
An agent summarizes the history and flags inconsistencies, but cannot change the requested amount or approve the discount. If margin data is unavailable, the request stops in an exception state instead of following a lower authority level. The dashboard shows response time, expired requests, returns for missing evidence and the percentage of decisions made outside the suggested route.
Measure the flow and recognize its limits
Track time to decision by authority level, waiting time by approver, first-pass completeness, expiration, reassignment, rejection and post-approval changes. If one person still receives most requests, review the matrix and the available capacity.
Automation does not resolve ambiguous policies or outdated authority data. Excessive thresholds can encourage split requests, while excessive exceptions return the operation to manual work. Periodic review is part of the control.
NM Solutions helps companies map approval rules, authority levels, integrations, evidence and exception paths around real operations. A diagnostic can identify where deterministic checks, agents and human decisions should enter the flow without making governance slower than the business it protects.