Customer data glossary
Draft-approve-execute split
The draft-approve-execute split gives three steps to three actors: the agent proposes, a named person approves with a diff and a count, and an execution service with its own credentials acts.
By Art Kukharenko · Published · Updated
All glossary termsPart of the Learn hub and the customer data glossary.
What it means in practice
The draft-approve-execute split keeps write credentials out of the model's session, so a hijacked or mistaken draft cannot change anything by itself. Each step has a different holder.
Scroll horizontally to see all columns.
| Step | Who | What they hold | What the ledger records |
|---|---|---|---|
| Draft | Agent | Read and propose tools only | Draft version and hash |
| Approve | Named person, never the requester | A decision bound to that hash | Approver and time |
| Execute | Execution service | Its own credentials; consent and suppression rules | Outcome and count |
The split also fits the Agents Rule of Two. A session should hold at most two of untrusted input, sensitive data, and the ability to change state or communicate externally 1. Moving execution elsewhere removes the third.
Vendors follow the pattern. Tealium's Configuration MCP saves AI changes as draft revisions, and publishing stays a manual step in its interface 2. The segmentation walkthrough shows one worked audit trail.
Not every job needs all three steps. An L1 summary has nothing to execute. An L4 action is approved once, in advance, as a written rule, so no one approves each run.
The split is a vendor-neutral pattern. PrivyCDP exposes open APIs, webhooks and an MCP-ready interface for agent connectivity, so the pattern can be applied on top of it.
Example (iGaming operator, illustrative): the Data Quality Triager, at L2 to L3, proposes a format-only fix with a rollback plan. A data steward approves the batch, and a separate service applies it. The fix path holds no consent fields.
Related terms
- Approval gate: the middle step.
- Rail level: the split begins at L3.
- Rail card: Tool scope and Gate record it.
- Audit ledger: records all three steps.
- Activation: a common execute step.
Where it matters
- Rail levels: the levels of AI agent autonomy: where each step applies.
- Data quality triage: proposals and fixes kept apart.
Back to the customer data glossary or the Learn hub.
Browse use casesFunction playbooksAgent roster
FAQ
Is this the same as human in the loop?
It is narrower. Human in the loop can mean any human check. This split also says who holds the credentials, so approval is enforced by the system and not only by the process.
Does a small team need a separate execution service?
It needs the separation, not a large system. A small script with its own credentials can act as the service, as long as the agent cannot reach those credentials.
Sources
Further reading
- AI Agent for Data Quality Triage: Data
- AI Agents for Data Quality
- Data Quality Monitoring AI Agent: Triage
- Agent rails
- AI Agent Permissions Template Download
Published: · Updated:
Editorial dates describe content changes. Confirm current sources before making legal, security or purchasing decisions.