# Draft-approve-execute split

**The draft-approve-execute split gives three steps to three actors: the agent proposes, a named person approves with a diff and a count, and an execution service with its own credentials acts.**

*Part of the [Learn hub](https://privycdp.org/learn) and the [customer data glossary](https://privycdp.org/learn/glossary).*

## What it means in practice

The draft-approve-execute split keeps write credentials out of the model's session, so a hijacked or mistaken draft cannot change anything by itself. Each step has a different holder.

| Step | Who | What they hold | What the ledger records |
|---|---|---|---|
| Draft | Agent | Read and propose tools only | Draft version and hash |
| Approve | Named person, never the requester | A decision bound to that hash | Approver and time |
| Execute | Execution service | Its own credentials; consent and suppression rules | Outcome and count |

The split also fits the Agents Rule of Two. A session should hold at most two of untrusted input, sensitive data, and the ability to change state or communicate externally [1](#source-1). Moving execution elsewhere removes the third.

Vendors follow the pattern. Tealium's Configuration MCP saves AI changes as draft revisions, and publishing stays a manual step in its interface [2](#source-2). The [segmentation walkthrough](https://privycdp.org/ai/agent-assisted-segmentation-walkthrough) shows one worked audit trail.

Not every job needs all three steps. An L1 summary has nothing to execute. An L4 action is approved once, in advance, as a written rule, so no one approves each run.

The split is a vendor-neutral pattern. PrivyCDP exposes open APIs, webhooks and an MCP-ready interface for agent connectivity, so the pattern can be applied on top of it.

**Example (iGaming operator, illustrative):** the [Data Quality Triager](https://privycdp.org/ai/rails/agents/data-quality-triager), at L2 to L3, proposes a format-only fix with a rollback plan. A data steward approves the batch, and a separate service applies it. The fix path holds no consent fields.

## Related terms

- [Approval gate](https://privycdp.org/learn/glossary/approval-gate): the middle step.
- [Rail level](https://privycdp.org/learn/glossary/rail-level): the split begins at L3.
- [Rail card](https://privycdp.org/learn/glossary/rail-card): Tool scope and Gate record it.
- [Audit ledger](https://privycdp.org/learn/glossary/audit-ledger): records all three steps.
- [Activation](https://privycdp.org/learn/glossary/activation): a common execute step.

## Where it matters

- [Rail levels: the levels of AI agent autonomy](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder): where each step applies.
- [Data quality triage](https://privycdp.org/ai/rails/use-cases/data-quality-triage): proposals and fixes kept apart.


Back to the [customer data glossary](https://privycdp.org/learn/glossary) or the [Learn hub](https://privycdp.org/learn).

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### Is this the same as human in the loop?

It is narrower. Human in the loop can mean any human check. This split also says who holds the credentials, so approval is enforced by the system and not only by the process.

### Does a small team need a separate execution service?

It needs the separation, not a large system. A small script with its own credentials can act as the service, as long as the agent cannot reach those credentials.

## Sources

1. Meta, Agents Rule of Two (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
2. Tealium, About Tealium Configuration MCP: https://docs.tealium.com/server-side/config-mcp/about-config-mcp/


## Further reading

- [Data Quality Triager: An AI Agent That Sorts Data Failures](https://privycdp.org/ai/rails/agents/data-quality-triager)
- [AI Agents for Data and Analytics Teams: The Playbook on Rails](https://privycdp.org/ai/rails/functions/data-and-analytics)
- [Data Quality Triage: Sort and Fix Failures With an AI Agent on Rails](https://privycdp.org/ai/rails/use-cases/data-quality-triage)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)