Automate Approval Workflows Without Removing Approval

Approvals move through email threads and spreadsheets. The requester cannot see who has the decision. The approver receives half the context, asks for the missing attachment and then the latest answer is copied into another tracker by hand.

The pain is not that a person has to approve. The pain is everything around that decision: incomplete intake, uncertain ownership, manual chasing, duplicated entry and no reliable record of what happened.

The first useful automation keeps the approval. It removes avoidable movement around it.

This is one of the repeatable queues covered by APIwise's AI automation service, although a good approval flow often needs ordinary rules before it needs AI.

Follow one real request from start to finish

Choose a recurring approval with a clear owner, such as a purchase request, supplier setup, document sign-off or controlled discount. Avoid starting with the highest-risk or rarest exception.

Record the real route:

1. What triggers the request?
2. Where is the request captured?
3. Which fields and attachments are required?
4. Who can approve at each value or risk level?
5. What happens when information is missing?
6. How is absence or delay handled?
7. Where is the decision and comment stored?
8. What downstream action follows approval or rejection?
9. Which person checks that downstream action completed?

Include unofficial steps. If someone sends a Teams message because the official email is often missed, that is part of the current process.

Separate the decision from the queue

An approval workflow contains different kinds of work:

• Capture: collect the request and its supporting evidence.
• Validation: check required fields, limits and formats.
• Routing: find the correct approver from agreed rules.
• Decision: approve, reject or request more information.
• Chasing: remind or escalate under a defined policy.
• Recording: store the outcome, comment, time and identity.
• Execution: create the order, update the record or prepare the next action.
• Exception handling: contain requests that do not fit the ordinary path.

Capture, validation, routing, chasing and recording are usually strong automation candidates. The decision remains with an authorised person. Execution may also remain controlled, particularly where it creates a financial, contractual or customer consequence.

This distinction prevents a common mistake: replacing a slow but necessary control with a fast opaque rule.

Fix the request before automating the route

An approver cannot make a good decision from an empty subject line and an attachment called final-v3.xlsx.

Define the minimum request packet. Depending on the process, that may include:

• Request type and business reason.
• Amount, supplier, customer or project.
• Cost centre, budget or contract reference.
• Evidence and source-system link.
• Requester and accountable owner.
• Risk or exception flags.
• Required-by date.
• Prior decisions or related requests.

Make required data explicit at intake. If a value is missing, return the request to the requester before it reaches the approval queue. Automation should make the decision easier, not deliver incomplete work more quickly.

Write the routing rules in plain English

Start with a decision table that the process owner and approvers can understand.

Condition	Approver	Additional control
Ordinary request within the agreed limit	Named budget owner	Required fields complete
Request above the limit	Budget owner, then senior approver	Sequential approval
New supplier or changed bank details	Procurement or finance owner	Independent verification
Missing or conflicting information	Exception owner	No approval request yet
Approver absent beyond the agreed period	Named delegate or escalation owner	Full context retained

Avoid routing to “the manager” unless the system has a reliable, maintained relationship for that person. Avoid first-to-respond approval when policy requires every named approver or a particular sequence.

Microsoft's current Power Automate documentation supports first-response, everyone-must-approve, custom-response and sequential approval patterns. The product can route and wait for a response, but the business still has to choose the right control.

Keep one visible source of status

Email can notify an approver, but it should not be the only record of the workflow.

Store each request in a controlled system with:

• A unique request ID.
• Current status and current owner.
• Created, submitted, decided and completed timestamps.
• The decision and approver comment.
• Reminder and escalation history.
• A link to the evidence used.
• The downstream outcome or failure.

Notifications should link back to that record. A reply in one private inbox should not create a second source of truth.

The requester needs a simple status view: received, needs information, awaiting a named role, approved, rejected, failed after approval or completed. That visibility removes much of the chasing without changing the authority to decide.

Automate reminders without creating noise

Agree the reminder and escalation policy before configuring it.

Specify:

• The normal response period.
• Whether reminders count working days.
• How many reminders are appropriate.
• Who receives an escalation.
• Whether a delegate can decide.
• What happens when a request expires.

Do not send identical reminders every few hours or silently reassign approval. The system should preserve ownership and make the escalation visible.

Where a process has urgent and ordinary work, define urgency from evidence rather than letting every requester mark their request urgent.

Protect financial and identity controls

Approval automation is not permission to collapse separation of duties.

For supplier changes, payments and other sensitive instructions, preserve independent checks. The UK National Cyber Security Centre advises verifying important email requests through another method. A workflow can require that verification and record that it happened, but it should not treat the email that requested a bank-detail change as proof that the change is legitimate.

Keep appropriate people involved in:

• Creating or changing a supplier.
• Verifying changed payment instructions.
• Approving material or unusual spend.
• Preparing and releasing payments.
• Resolving conflicts of interest.
• Overriding a policy or threshold.

The exact roles depend on the organisation. Document them before building the flow.

Use AI only where uncertainty is contained

Many approval workflows need no AI. A form, decision table and workflow tool may be enough.

AI can help when requests arrive as unstructured emails or documents. It might propose a category, extract an amount or summarise supporting text. Treat those outputs as suggestions with validation and confidence thresholds.

If an uncertain classification would send a request to the wrong authority, route it to a person. Do not let an AI-generated summary replace access to the source document, and do not let a model approve its own extraction.

Test the exception path, not only the happy path

Build a small test set from real patterns, with confidential details removed where appropriate:

• A complete ordinary request.
• A request just below and just above a threshold.
• Missing evidence.
• An unknown or absent approver.
• A rejection with comments.
• A request returned for more information.
• A duplicate submission.
• A downstream system failure after approval.
• A supplier or payment-detail change.

Confirm that no request disappears, no action runs twice and no rejection is presented as an approval. Test access controls as well as routing.

Measure the queue before and after

Record the current baseline for a representative period:

• Requests received by type.
• End-to-end elapsed time.
• Time waiting for approval.
• Manual chasing touches.
• Requests returned for missing information.
• Routing corrections.
• Expired or lost requests.
• Downstream failures and duplicate actions.
• Time people spend preparing, deciding and administering requests.

Review the same measures after 30 and 90 days. The aim is not simply fewer emails. It is a more visible queue, less avoidable administration and controls that still work.

Do not promise an hours-saved figure before measuring the actual volume, waiting time and exception rate.

Where APIwise fits

APIwise maps the existing route, separates stable rules from judgement, checks the available features in your current systems and scopes the smallest controlled workflow. If Microsoft 365, an accounting platform or another existing tool can handle it safely, we will say so.

A custom integration is justified when requests cross systems, identities or data models that standard workflow features cannot handle reliably. AI is justified only where unstructured input creates a real bottleneck and its uncertainty can be contained.

If approvals are stuck in email and spreadsheets, show APIwise where the queue builds up. We can map one recurring workflow, its controls and the baseline before proposing a build.

Sources used

• Microsoft Learn: get started with Power Automate approvals
• Microsoft Learn: create an approval flow that requires everyone to approve
• Microsoft Learn: manage approval requests
• NCSC: business email compromise and payment diversion fraud