AI that asks before it changes anything: roles, approvals and audit logs explained

Last verified: 17 October 2026

Short answer

Letting an AI assistant work in your business systems is only safe if you decide three things in advance: which role it acts as (what that person may see and change), which actions need a person to approve first, and where a record of each action is kept. Claude, ChatGPT, Business Central, NetSuite and Shopify each give you part of this, but each works differently and only inside its own product. A company with several systems needs one consistent set of rules.

The three controls in one minute

Role: The bundle of things one person may see and do. The assistant should act as a person with a role, never as a master key.
Approval: A step where the assistant proposes a change and a named person says yes before anything is written.
Audit log: A record of who asked for what, in which system, what changed, when, and who approved it.

Why reading and changing need different rules

Reading a report cannot change your business, though it can still leak something, so it needs care. Changing can cost money straight away. A retailer's price change can reach every branch and the online store within minutes. A restaurant's stock adjustment can make a branch show an ingredient as out of stock. A distributor's purchase order can commit cash to a supplier.

A wrong answer wastes an afternoon. A wrong change has to be found, traced and undone. That is why most of this guide is about the second kind of action.

Roles: the assistant acts as someone

Your systems already have roles. A branch manager sees their own branch, an accountant sees invoices, an owner sees everything. The assistant should inherit one of these, not sit above them. Examples, for illustration:

Retail: a branch manager asks about sales and stock for their own branch only. Head office asks across all branches. Neither sees staff pay.
Restaurants: a kitchen manager sees stock and wastage. A finance lead sees supplier invoices and payments. A shift supervisor sees today's sales but not margins.
Distribution: a sales rep sees their own customers' orders and credit limits. A warehouse lead sees stock and transfers. Only finance sees supplier payment terms.

Some tools already work this way. Business Central runs every operation under the signed-in user's identity and permissions. NetSuite's AI connector does not support Administrator roles, and its tools run with the permissions of the role that signed in. Claude takes on each person's permissions in the connected service. Shopify limits an AI tool to the data access level you approved and the signed-in user's own permissions.

The opposite is a shared key. With a shared credential, Claude's help centre says everyone who uses the connector reaches the service with the same access. The log then shows one name, and you cannot tell who asked.

Approvals: which actions need a person

Decide this before you connect, not after the first mistake. A workable split:

Reading: no approval, limited by the role.
Small changes you can undo: the person using the assistant confirms.
Anything touching money, stock, prices or customers: a named manager approves. For payments, make it someone other than the person who asked.
Deleting, posting and paying: blocked at first.

There are two kinds of control, and they are not the same. A prompt asks someone to click Approve. A hard switch means the assistant cannot do the action at all. Use prompts for routine changes and hard switches for the dangerous ones.

Prompts: Claude shows tool approval requests, but "Allow always" removes the check for that tool, and in research mode connector tools can run without further approval. Anthropic's article advises switching write tools off there. ChatGPT may ask for confirmation depending on the app's permissions and the action, and OpenAI says some especially risky actions may be blocked instead of offered for approval.
Hard switches: on Claude Team and Enterprise, Owners can set each connector tool to Always allow, Needs approval or Blocked. In Business Central, an admin turns on create, modify, delete and actions separately for each API object. On ChatGPT Enterprise and Edu, admins can switch individual actions on or off, and new actions from an updated server start switched off.

One catch. A prompt in the chat asks the person using the assistant. If your rule is that a manager approves price changes, check that the tool can send the request to the manager.

The audit log: the record of what happened

A useful entry holds six things: who asked (a named person), which assistant, which system, what was read or changed, the values before and after a change, and who approved it. Check that you can read the log, keep it as long as you need, and that the people being logged cannot edit it.

A record can live in three places: in the assistant, in your business system, or in a log you keep yourself. Each sees different parts. The assistant knows the question. The business system knows what changed. For the full picture you need both, matched by time and user.

Retention differs. NetSuite keeps its AI connector's Execution Log for 21 days in production and 7 days in sandbox. Claude's audit logs are for Enterprise organisations only, and an export covers the past 180 days. Chat history is not an audit log, because people can delete their chats.

How built-in tools handle it today

What each vendor's own pages say on 17 October 2026:

Tool	Read-only and approvals	Whose permissions	Record kept
Claude (Team, Enterprise)	Owners set each connector tool to Always allow, Needs approval or Blocked, for everyone. Users see approval requests in chat.	Each person's own permissions in the connected service. A shared credential gives everyone the same access.	Audit logs for Enterprise only, with a 180-day export and no chat content. Compliance API for Enterprise.
ChatGPT (Business, Enterprise, Edu)	Business: only admins and owners create and publish custom connectors. Enterprise and Edu: admins switch actions on or off, and new actions start off. Risky actions may be blocked.	Depends on how the connector signs in. On Enterprise and Edu, admins use role-based access to choose who can use each app.	Compliance API for Enterprise and Edu, including conversations that use apps.
Business Central	Read-only by default. An admin switches on create, modify, delete and actions for each API object.	The signed-in user's identity and permissions.	The audit trail shows who performed each action.
NetSuite	Standard tools can create, read and update records, run reports and run read-only queries. Oracle advises an internal approval process for AI clients and tools.	A non-Administrator role. Queries respect that role's permissions.	Execution Log on each integration record: 21 days in production, 7 in sandbox.
Shopify	You approve a data access level at install, read-only or including write. To lower it, you uninstall and install again.	The user's own Shopify permissions limit what the tool can do.	Not described on Shopify's authorisation page. Ask.

Sources: Claude, OpenAI, Business Central, NetSuite, Shopify. Plans and menus change.

Each control lives inside its own product. Three systems means three sets of roles, three kinds of prompt and three logs.

Hidden instructions and why approvals matter

An assistant reads text, and text can carry instructions. OpenAI describes prompt injection as harmful instructions hidden in ordinary content such as a web page, a document or an email, meant to trick the assistant into doing something you did not ask for. A supplier's PDF or a customer's note could try to steer an assistant that has write access. Approval before changes and narrow roles limit the damage. Our guide on whether it is safe to connect company data to ChatGPT or Claude covers this in more detail.

A starter policy you can copy

Action	Examples	Suggested rule
Read summaries and reports	Sales by branch, stock on hand, open invoices	Allowed for the person's role. Logged.
Read personal or sensitive data	Customer lists, staff pay, ID numbers, bank details	Off by default. Named roles only, and only where the job needs it.
Small changes you can undo	Adding a note or tag, saving a draft	Allowed with the user's confirmation. Logged.
Changes that touch money, stock or customers	Prices and discounts, refunds, stock adjustments, purchase orders, messages to customers	Always needs approval from a named manager. Record the values before and after.
Delete, post or pay	Deleting records, posting invoices, sending payments	Blocked at the system level until you have run read-only for a while and someone owns the decision.

A starting point, not a standard. Adjust it to your own risks and to any rules your sector follows.

What to ask any vendor

Whose permissions does the assistant use? A named person's, or a shared key?
Can we start read-only? And switch on create, change, delete and actions one at a time?
Which actions need approval, and who gets the request? Can it go to a manager, not only the person chatting?
Can we block specific actions outright? For example delete, post and pay.
What is recorded for each request? Who, which system, what changed, before and after, when, who approved.
How long is the log kept, and can we export it? To a place we control.
What happens when a tool changes? Are new actions off until we approve them?
How fast can we switch it off? For one person, and for everyone.

Questions people ask

Do we need all of this on day one?

Start with three: read-only access, a person's own permissions, and a way to see what happened. Add approvals before the first time you allow any change.

Who should approve changes?

Someone with authority over that decision, such as a finance lead for payments or a category manager for prices. Name a backup so requests do not wait for one person.

Is the chat history an audit log?

No. It belongs to the user, it can be deleted, and it does not show what the connected system did. On Claude, a deleted chat leaves the history at once and back-end storage within 30 days.

What if a tool has no approval feature?

Keep write access off in that tool, or limit it to creating drafts that a person releases inside the business system.

Where Vootlabs fits

Everything above exists today, but inside individual products. Vootlabs is designed so the same access by role, approval before any change and a full audit trail apply across all the systems you connect, whichever assistant your team uses, whether that is Claude, ChatGPT or Microsoft Copilot.

We are onboarding a limited number of companies in a design-partner programme. If you run several systems and want one set of rules across them, we would like to hear what you need.

Book a demo Join the design-partner programme

Sources

Plans and menu names change. Check the live vendor page before you act. All pages below were read on 17 October 2026.

By the Vootlabs team. Last verified 17 October 2026.