How to Automate Approvals Without Increasing Business Risk

The answer

The risk in approval automation is not the automation itself — it is automation without enforcement. When you automate an approval without a policy layer, you have removed the human check without replacing it with anything. Corules replaces the human check with a deterministic policy check. Low-risk, policy-compliant decisions auto-approve because they have been validated — not because they were waved through. High-risk or ambiguous decisions escalate to humans. This is risk reduction, not risk increase.

How it works

Corules's policy runtime sits in the enforcement path between your AI agent and the action it wants to take. The agent sends a structured context payload to /v1/validate. Corules evaluates the context against a compiled CEL policy set and returns a structured decision — ALLOW, BLOCK, or ESCALATE — with a reason and audit ID.

Every decision is recorded in an immutable audit ledger. You can replay any past decision by providing the policy_set_version and the normalized input hash — the result will be identical.

Policy example

Policies are written in CEL (Common Expression Language). They are compiled once at publish time and evaluated in microseconds at request time.

// Auto-approve: compliant + low risk
// Escalate: compliant + elevated risk
// Block: policy violation
context.amount <= params.auto_approve_limit
  && context.risk_score < params.escalation_threshold
  && context.vendor_approved == true

Frequently Asked Questions