You decide on each draft yourself, in Kanonik, signed in under your own name.
If your AI sends several drafts at once, they come to you as one request.
A reply typed into a chat doesn’t count as an approval, and the AI can’t approve anything at all.
Dana’s AI sent her three drafts, and this is what she did with them.
Dana Reyes runs security at Harbor Ledger, a 40-person fintech we made up for this example.
- Kanonik
The link reaches her.
By email, at the address on her sign-in. If Harbor Ledger has turned Slack on, a notice there says a request is waiting and points her to To decide. Her AI also passes the link along in the chat.
- Dana
She reads each item.
She sees the draft, what changed since the version on the record, and what the safety check found. Does she have to read every item? She does. The approve button stays grayed out until she ticks that she’s read it.
- Dana
She decides on each one.
Approve it, send it back to her AI with a note in her own words, or reject it. A send-back or a rejection needs a reason, and the reason stays with the item.
- Kanonik
Nothing goes on the record until she has decided on the last item.
Her ticks and decisions are saved as she goes. The link works for about an hour, and after that she carries on from To decide. Say a request holds eight drafts. She approves six, sends one back and rejects one. Six entries go on the record, each with her name and the time, and the other two never show up there as approved.
Named approval is one of five stops between your AI and your Record
Try to skip the approval
- Your AI
- Dana
- Sam
You’re the AI. Get Dana’s three drafts onto the record.
Control
Quarterly review of production admin access
DraftNot accepted yet
Not on the record
Control
Access removed within one working day of leaving
DraftNot accepted yet
Not on the record
Conformance confirmation
Security keys for admin sign-in against ISO 27001 A.8.5
DraftNot accepted yet
Not on the record
On the record: 0.
Tighten admin access in production, 3 items. Nothing has been sent yet. Watch your AI send them for approval.
Sample data from Harbor Ledger, a made-up company. Tool results are shortened where they say so; their words, like the words on Dana’s page, are Kanonik’s own. Nothing is saved.
Sam confirms the drafts that need a second person, and the record shows both names.
Harbor Ledger has two people who can approve, so some of Dana’s drafts need Sam as well. Policies, procedures and controls are among them. So are exceptions, risk acceptances, decisions about which requirements apply, and statements that a control meets a requirement.
On those, Dana’s click is Accept. The item waits for Sam, with no deadline, and he confirms it in his own To decide list. Evidence, vendors, assets, risks and questionnaire answers she can approve alone.
Whoever asked the AI for the work should answer for it before anyone else, so the first click on a request is always theirs. If a colleague opens Dana’s link, Kanonik tells them it’s meant for someone else.
In a workspace where you’re the only one who can approve, you approve alone and tick one more box to say so. The record shows it. Your auditor doesn’t see anything that’s still waiting for a decision.