finnHow-to
How to set AI permissions and approvals without slowing everything down.
Define what an agent may read, prepare, change, and send—and which decisions stay with people.
A sales agent may need to read customer details and prepare a quote. That does not mean it should change pricing rules or send every draft without review. A practical permissions plan starts with one job and separates its actions.
1. List the exact effects.
For a quote workflow, distinguish reading product data, creating a draft, applying a discount, and sending the quote. For each action, identify the system that owns it and the people entitled to authorize it.
Avoid a broad instruction such as “manage sales.” It leaves both the operator and the agent guessing about the boundary. Configure only the supported actions the workflow needs.
2. Define the exception that requires review.
Specify when a person must decide: a discount outside standard terms, a recipient change, or a quantity beyond a limit. Make the approval request show the actual proposal and relevant facts.
If the proposal changes materially after approval, check whether it requires a new decision. Approval of one price should not become permission to send a different price.
3. Keep access and model controls separate.
An application’s permission to use an AI model does not grant access to customer records. Nor does an AI spending budget determine how much an agent can refund. These controls operate at different points.
Finn Gateway applies rules to requests routed through it. The connected business actions still need their own authorization. Review both when introducing a workflow, instead of assuming one makes the other unnecessary.
4. Test both permitted and denied cases.
Use an ordinary request, an exception requiring approval, a denied request, and a user from another location. Check that the system explains a missing permission without revealing protected information.
Make an owner responsible for reviewing grants when roles change. Good permissions should let routine work proceed while giving consequential exceptions a clear path to the right person.