Free template
As AI agents take on more delivery work, every team needs one clear answer: who approves what the AI did? This matrix sets that out by kind of action. Copy it, then change the roles to yours.
| AI action | Example | Risk | Who approves | Record to keep |
|---|---|---|---|---|
| Draft text | Story, meeting notes, release notes | Low | The person who uses it | None beyond the document |
| Suggest a change | New acceptance criteria, a re-plan | Medium | The owner of that work | Who accepted it, and when |
| Change priority or scope | Reorder the backlog, move a story | Medium | Product owner | Change log with the reason |
| Write code | A fix or feature in a pull request | Medium | A code reviewer | The pull request and its review |
| Merge or release | Merge to main, deploy | High | Release owner, never automatic | Deployment record |
| Contact people outside the team | Email a customer, post publicly | High | A named owner, before it is sent | The message and its approver |
| Read sensitive data | Customer or personal data | High | Data owner, under your policy | Access log |
| Change access | Permissions, roles, accounts | High | An administrator, with a second check | Audit trail |
Because AI tools now draft, change and sometimes act on delivery work, and without agreed rules nobody knows who is accountable for the result. A matrix sets out, by kind of action, who approves it and what record is kept, before something goes wrong.
For most teams, no. AI can write the change, but a person should review the merge, and a named release owner should make the release decision, with a record of both. Lower-risk actions, such as drafting notes, need far less control.
SyncupHUB checks requests as they arrive, reads status and risk from the work, and keeps the evidence for every release, with AI that proposes and people who approve. Cloud is free for the first month.