AWS has detailed Smart Approvals in Amazon Quick, a control intended to reduce repetitive approval prompts while keeping consequential agent actions in front of a person. The capability reviews only actions that are already eligible under an organisation’s policies and the user’s settings. It does not grant an agent new authority, remove mandatory approval requirements or override a denial.
The 4 November announcement addresses a growing problem in agentic software. If every step in a multi-stage workflow asks for confirmation, people can become conditioned to click through warnings. The result is approval fatigue: a mechanism designed to preserve oversight may instead dilute attention when an important decision finally appears.
Policy remains the hard boundary
Before Smart Approvals evaluates anything, Amazon Quick checks the proposed action against Custom Permissions, Quick Guardrails, connector action permissions and user settings. A denied action stays denied. An action configured to require human approval still goes to a person. Automated review is available only when the action would otherwise use an “Ask each time” setting and no other control requires direct approval.
Administrators can decide who is allowed to use Smart Approvals through Custom Permissions. Users can also disable it for themselves across conversations and scheduled runs. AWS says an account administrator cannot silently switch it back on for a user who has opted out.
This ordering is important. It separates authority from judgement. The permission service decides whether the action may proceed at all; the classifier considers whether an eligible action matches the request closely enough to avoid interrupting the user.
A separate classifier reviews intent and impact
Smart Approvals uses a separate model to compare the proposed action with the user’s request and a bounded view of the conversation. It considers what the action will do, where information will go and who will be affected. It may consult the user’s knowledge graph to understand working relationships, such as whether a recipient sits in the person’s reporting chain. AWS says this lookup remains inside the Quick account.
The company also says the reviewed content, including knowledge-graph information, is not used to train models or improve the service. That distinction will matter to enterprises assessing whether an automated reviewer introduces a new data-use path.
An action can be permitted and still be escalated. Examples include sending material outside an organisation, contacting senior leaders, changing access, deleting records or initiating payments. The classifier also compares retrieved material with the original request to reduce the risk of indirect prompt injection, where content encountered by an agent tries to redirect its behaviour.
Approvals are exact and single-use
When Smart Approvals accepts an action, the approval applies only to the reviewed action and parameters. It creates no continuing permission and cannot be reused for a different audience or payload. Automatic approvals are labelled in the conversation. Timeouts, classifier failures and cases that are not approved return to the user rather than defaulting to execution.
AWS illustrates the boundary with a business-review brief. If a user asks Quick to send the brief to two named colleagues, an eligible send can be reviewed against that instruction. If a retrieved account note tells the agent to add a distribution list of thousands of people, that changes the audience beyond the request. Smart Approvals is designed to return the wider send for human review, and an approval for the two original recipients cannot authorise it.
Audit records support investigation
The Quick permission service records Smart Approvals-related permission updates in AWS CloudTrail, including the user, connector, action and time. It also records permission-check outcomes and changes to the user’s setting. AWS cautions that an approval record does not prove the destination system completed the action.
Investigators can correlate CloudTrail events with chat logs, agent metadata and records from the external system. CloudWatch Logs can hold the delivered logs, while the destination system remains the source of truth for whether a message was sent, a ticket changed or another action completed. Organisations needing more than CloudTrail Event history’s standard retention should configure a trail and protect potentially sensitive chat logs.
What the design gets right—and what remains
Smart Approvals reflects a useful security principle: automate low-risk repetition without converting model confidence into unrestricted authority. Mandatory policies stay deterministic, approvals are scoped to exact parameters, and review failures fall back to a person.
The residual risk is classification quality. AWS explicitly notes that enforcement boundaries limit what an approval authorises but do not prove the classifier made the right judgement. Organisations still need to mark sensitive actions as always-human in connector permissions, test the feature against realistic workflows and monitor whether its escalation behaviour matches their risk appetite.
For teams deploying agents at scale, that balance may be more sustainable than asking for confirmation at every turn. The aim is not fewer controls; it is to concentrate human attention on moments where judgement actually changes the outcome.