human approval: how an internal AI tool does not message a customer on its own

human approval is what this article is about, even when the technical tool has another name. For a field-service company the day looks like this: jobs in a group, addresses in a voice note, and job completion on the technician’s phone. No message to a customer leaves an agent or a bot before a person approves it. The draft waits, someone allowed approves or corrects it, and only then it is sent and written on the card. Human approval is what connects an AI agent and a WhatsApp bot to the information system without losing control. Only a role you defined can approve. Everyone else can look, not send. We do not add approval for show. If there is no risk, there is no queue. If there is risk, nothing sends itself. The rest of the article is how a software house builds that without leaving the team with a demo.

Claude and similar frontier models are attractive for internal tools because staff already work in language-tickets, wikis, policy PDFs, and spreadsheets full of prose. The engineering task is to harness that flexibility without turning every chat box into an uncontrolled data egress.

Scope use cases narrowly. Prefer assistants that draft within templates, extract structured fields from known forms, or route issues using rubrics you can version. Open-ended “ask anything” panels are harder to secure, test, and support.

Ground answers in organizational knowledge through retrieval-the model should cite or rely on snippets from controlled corpora with freshness SLAs. Maintain provenance: which documents informed an answer, when they were indexed, and whether they were authoritative.

Treat model output as untrusted at system boundaries. Validate structured payloads before writes; sanitize free text before mass emailing; enforce authorization in your app before selecting records to retrieve or summarize.

Enterprise deployments increasingly emphasize data minimization and retention choices. Review provider documentation for API logging, retention controls, and organizational settings-then map choices to your risk register. Healthcare and finance contexts may require additional contractual instruments beyond default online terms.

Operationalize abuse cases: prompt injection from ticket content, accidental paste of secrets, and excessive automation of privileged actions. Combine instruction/data separation, output filters on tool calls, and allowlisted tools with argument schemas.

Testing uses golden transcripts: anonymized real examples with expected JSON or classification outcomes. Re-run when models, prompts, or parsers change. Track latency and token budgets per workflow to catch silent bloat.

Developer ergonomics: centralize API keys server-side; never ship long-lived secrets to browsers for internal prototypes that become production. Use environment-based configuration and per-tenant routing if you serve multiple divisions.

Support model fallback: if the API errors or rate-limits, degrade to cached responses, simpler models, or human queues with clear messaging. Resilience beats demo-perfect happy paths.

In summary: Claude accelerates internal workflows when tasks are bounded, knowledge is grounded, validation gates writes, and data handling aligns with procurement, security, and privacy reviews-treating the model as a component inside a governed platform, not magic middleware.

You can come back from here to a plain conversation: Bring an example of a message that must not go out alone, and one that may go out at once. The queue is short because only what needs a person is waiting. The rest is already filed. AI agents, an information system and a WhatsApp bot stay the same offer, with human approval, from an official Meta provider.