Approvals and audit for AI agents
An agent prepares the work. What it may write on its own, what waits for a named person on your team, and who that person is, are set for each workflow. Every action goes on the record: the input, the sources, the rule, the result and who approved it.
Written down for each workflow
Before a workflow goes live, the forward deployed engineer writes down with your team what the agent reads, what it prepares, what a person decides and where the result is written.
- Workflow
- Subcontractor invoice check
- The agent reads
- Invoices received by email, the purchase order, the signed delivery notes
- The agent prepares
- The ERP entry for every line that matches
- Held for a person
- Any line billed above the agreed rate, any line without a delivery note
- Approver
- The site manager named for the project
- Written to
- The ERP, once approved
- Recorded
- Inputs, sources, rule, result, approver
Thresholds decide what a person sees
Anything past a threshold goes to a person, with its sources attached. Thresholds are written per workflow, in the operation's own terms, not as one setting for the whole platform.
| Workflow | Held for review when | Reviewed by |
|---|---|---|
| Subcontractor invoices | A line is billed above the agreed rate | Site manager |
| Freight quotes | A lane is quoted above the contracted rate with no approval on file | Pricing lead |
| Customer orders | Quantities do not match the purchase order | Order desk |
| Plan revisions | A quantity changes between two revisions of a sheet | Estimator |
Illustrative thresholds. Each deployment writes its own.
In production at Biodéal, orders that pass the company's rules are created in SAP Business One by the agent, and about 7% are flagged for a person to check. On other workflows, nothing is written before the approver signs off.
See the Biodéal case studyAccess by role
Access rights are set by role, and each role sees and does what its workflows need. Role names and scopes are set in each deployment.
Reviewer
Works the review queue: checks each flagged item against its sources, then corrects or rejects it.
Approver
A named person who approves what is written to your systems, for the workflows assigned to them.
Your administrator
Decides who holds each role and who approves what.
Mirage engineers
Access limited to what the deployment needs, and you can remove it.
The audit record
Every agent action is logged with the inputs it received, the sources it relied on, the rule it applied and the result it produced, so any figure can be traced back to the document it came from. When Mirage runs in your infrastructure or your cloud account, the record stays there with the rest of the data.
A correction is not lost in the log: corrections and decisions your team makes become rules the system applies from then on.
- Time
- 09:42
- Workflow
- Subcontractor invoice check
- Input
- Invoice INV-5521, 14 lines, received by email
- Sources
- Purchase order PO-3307, delivery notes DN-118 to DN-124
- Rule
- Billed rate must not exceed the agreed rate
- Result
- 13 lines matched, line 9 billed above the agreed rate and held
- Decision
- Line 9 rejected, 13 lines approved
- Approver
- Site manager, project P-204
- Written to
- ERP, 13 lines
Frequently asked questions
It is set for each workflow with your team. Reading, comparing and flagging run on their own; anything past a threshold goes to a person. At Biodéal, orders that pass the rules are created in SAP Business One and about 7% are flagged for a check; on other workflows nothing is written before a named approver signs off.
Every agent action, with the inputs it received, the sources it relied on, the rule it applied, the result it produced and, where a person decided, the approver's name.
Permissions by role, the approvals your team gave, and the full history of what each agent read, decided and wrote. Any figure can be traced back to the document it came from.
Your team, with the forward deployed engineer, when the workflow is scoped. They are written in your operation's own terms.
Yes. Mirage's access is limited to what the deployment needs, and you can remove it.
Yes. Corrections and decisions your team makes become rules the system applies from then on, so the same exception is not settled twice.
Bring us the operation you need to improve.
Mirage will map the workflow, identify what can be automated and define the fastest path to production.
Start with a written plan
Tell us where your team loses time. We send back which workflows are worth automating, what a deployment involves on your systems and the shortest path to production. No commitment.