Otto

Email Approval Workflow: Steps, Rules and Examples

Email Approval Workflow: Steps, Rules and Examples

Founder reviewing an email draft before sending

An email approval workflow is a fixed path a draft takes before it can be sent: someone submits it, a named person reviews it, and the email goes out only after an explicit yes tied to that exact version. Everything else, from routing rules to audit logs, exists to make that one gate reliable. This guide covers how to build the process, how to handle revisions and silence, how to review outreach and scheduling emails, and how to keep a human in charge when AI writes the first draft.

Otto
Keep Email Decisions in Your Hands
Otto connects email, calendar, meetings and commitments in one shared memory, while you approve anything before it is sent or finalized.
Explore Otto

TL;DR

  • An approval workflow has five parts: an intake record, a routing rule, an explicit decision, a send gate and a log.
  • Tie every approval to one locked version. If the subject, body, links or audience change, review again.
  • Give reviewers three choices (approve, revise, pause) and treat silence as pending, never as a yes.
  • With AI drafting, the model can write and route, but only a human decision should release the send.
  • Scheduling emails need their own checklist: time, time zone, attendees, location or link, and any commitment the message makes.

Table of Contents

What an email approval workflow is

An approval workflow routes a request to the people who must decide, applies decision gates, records the outcome and blocks the next action until the required approval condition is met. Applied to email, the “next action” is the send.

Approval stages leading to a controlled email send

Two things are often confused with it. Forwarding a draft to a colleague and asking “look ok?” is a request, not a workflow. A workflow also defines who is allowed to decide, what they must see, what happens if they say no, and what happens if they say nothing.

The pattern shows up in very different places. A marketing team routes a campaign through a copy editor and a brand manager. An internal communications lead needs a director’s sign-off before an all-hands note. A founder wants to read every outbound message an assistant drafts. The mechanics are the same, only the stakes and the number of reviewers change.

The five building blocks

1. An intake record

Every submission starts with the same information. A reviewer should not have to hunt for context. A useful intake record holds the draft, the audience, the sender, the links, the template version and the reason for sending.

For a one-to-one email, you can shrink this to four lines: who it goes to, why you are sending it, what it promises, and what evidence backs any claim in it.

2. A routing rule

Decide in advance who reviews what. Common routing keys are content type, risk level, audience and policy. A routine reply to a known colleague might need no review at all. A message to a customer about pricing, a legal term or a refund goes to someone with authority over that topic.

Write the rule down in a sentence a new hire could apply: “Anything that quotes a price, commits a date or goes to more than 50 people needs the account owner’s approval.” Pick your own thresholds, but make them specific.

3. An explicit decision

A reviewer’s response should be a choice from a short list, not a mood. We recommend three outcomes:

  • Approve: send exactly this version.
  • Revise: here is what to change, then send it back to me.
  • Pause: do not send now, and here is why.

This mirrors guidance that recommends defining approve, revise and pause outcomes and presenting the reviewer with a stable version, the intended destination, the relevant risks and the requested action.

4. A send gate

The gate is what makes it a workflow rather than a habit. The email cannot be scheduled, exported or sent until the approved transition has happened. In a campaign tool, that can mean exporting only after every required approval is complete. In a personal assistant setup, it means the draft sits in a drafts state and no send button works for the AI.

5. A log

Record the approver, the timestamp, the outcome, any comments, the routing rule that applied and the version. A good record shows who acted, what they saw, when and why, which rule authorized the action, and what was finally sent. You will rarely need it. When you do, nothing else substitutes for it.

Lock the version you approve

The most common failure is simple: someone approves draft two, someone else edits it to draft three, and draft three goes out. Version locking prevents it. The approval should preserve the exact subject, body, links, audience logic, sender identity and template version, and a changed email should require a new review.

The same principle appears in campaign tooling: tying approval to a specific revision and blocking export until required approvals and comments are resolved stops last-minute changes from bypassing review.

Not every edit deserves a full second review. Agree on what counts as material:

Change Needs new approval?
Typo or punctuation fix Usually no, but log it
New or changed link Yes
Different recipient or list Yes
New price, date, or promise Yes
Changed sender identity Yes
Tone softened, facts unchanged Reviewer’s call, note it in the log

Handling revisions, rejections and silence

Revisions should return changed work to the reviewer, and material changes should reopen review. Rejections should carry a reason, so the author learns the rule rather than guessing.

Silence is the harder case. Delayed responses should leave the item pending, with a designated backup or a visible blocker, rather than silently becoming approval. Many informal setups quietly use “no reply means go”, and that is exactly the failure an approval step exists to prevent.

For time-sensitive sends, build the escape in advance:

  1. Name a backup approver for each reviewer.
  2. Set a reminder at a fixed interval, for example after four working hours.
  3. If the backup is also unavailable, the sender pauses or escalates. The email still does not send itself.

If you also chase replies from other people, our guide on tracking emails you are waiting on uses the same “pending is visible” idea from the other side of the inbox.

How to approve outreach emails

Outreach is where mistakes cost the most, because the recipient is often a stranger and you only get one first impression. A reviewer needs the exact draft, the recipient, the supporting evidence, any unconfirmed commitments and the proposed action. Assign two roles: who verifies the substance, and who has authority to approve. On a small team they can be the same person. On a larger one, separating them catches more.

A short outreach checklist for the reviewer:

  • Accuracy: is every claim about the recipient or their company true and sourced?
  • Personalization: does the specific detail belong to this person, or was it generated and left unchecked?
  • Promise: does the email commit to a price, a date or a deliverable the sender has not cleared?
  • Compliance: does it meet the rules for commercial email?

On the last point, in the United States the FTC says the CAN-SPAM Act covers all commercial messages and makes no exception for business-to-business email. The same guide lists requirements such as not using false or misleading header information. Other countries have their own rules, so check the regulator for the markets you email. If your outreach is high volume, ask a lawyer to confirm your template and opt-out handling.

If you want to see how the rest of a small business automation stack can fit around this gate, this overview of marketing automation for small business shows where a controlled sending step belongs among the other tools. For the follow-up emails that come after first contact, our follow-up templates give you wording you can drop into the same review step.

How to approve scheduling emails

Scheduling emails look harmless, which is why they slip through unreviewed. They are not harmless. A scheduling email is a commitment: it offers your time, names a place or a link, and tells another person to rearrange their day. A wrong time zone or a double-booked slot costs more goodwill than a clumsy sentence.

A scheduling approval should check six things against the live calendar, not against memory:

  1. Availability: are the offered slots actually free right now, including holds and travel time?
  2. Time zone: is it stated explicitly, for both sides, with the day of the week?
  3. Attendees: is everyone who should be invited on the thread, and nobody who should not be?
  4. Location or link: is the video link or address correct and unique to this meeting?
  5. Duration and purpose: does the invite say how long and why?
  6. Side commitments: does the message promise anything else, such as sending a document beforehand?

A practical rule is to let low-risk scheduling run with light review and to require a full look for anything involving an investor, a customer escalation, a board member or an external executive. Our walkthrough of safe ways to automate scheduling emails explains how to do this without double booking, and the idea of keeping AI drafts for review is covered in the email triage system guide.

Keeping a human in control when AI drafts

AI changes who writes the first draft, not who is accountable for the send. AI can draft, classify or route an email, but the workflow should keep the message in an approval state until an authorized human transition occurs. Version locking, explicit human decisions and a send gate keep the automation helpful without handing it final authority.

In practice, an AI approval workflow has a few rules:

  • The model can only create drafts. It cannot press send.
  • The draft shows its sources: the thread, the meeting note or the calendar entry it relied on.
  • Anything it is unsure about is flagged for the reviewer, not smoothed over.
  • An edit after approval cancels the approval.

The most useful reviewer habit is to look for what the model could not know. Before approving, run through the five checks before you hit send: wrong recipient, invented detail, missed context, tone and attachments. For the wider question of when an assistant should act and when it should ask, see our piece on human-in-the-loop AI.

A worked example

Imagine a founder who promised a prospect, on a Tuesday call, a revised proposal by Friday. The workflow runs like this:

  1. Intake: the promise is captured from the call and linked to the thread with the prospect.
  2. Draft: the assistant drafts the follow-up with the proposal attached and proposes a Thursday check-in slot.
  3. Routing: the email quotes a price and offers calendar time, so it goes to the founder, not a teammate.
  4. Review: the founder sees the draft, the recipient, the call note it came from and the free slots it checked.
  5. Decision: the founder changes the discount line. That edit reopens review, so the founder approves the new version.
  6. Send and log: the email goes out, and the log records who approved which version and when.

Nothing about this is heavy. It takes a minute, and the founder never has to remember the promise because the draft arrives with the reason attached.

Controls that make the process reliable

When you scale beyond one reviewer, add these controls:

  • Role separation and delegation: the author cannot approve their own high-risk email, and a delegate is named for absences.
  • Required evidence: claims in the email link to something the reviewer can check.
  • Explicit states: draft, in review, changes requested, approved, sent. Nothing skips a state.
  • Locked approved content: edits after approval are impossible or cancel the approval.
  • An event history that cannot be edited, so the log is trustworthy.

These are the controls that reliable approval processes rely on. Start with three (explicit states, version locking and a log) and add the rest as the volume or the risk grows.

Perspective: the approval step should be cheap

We build Otto, and we have a strong view here. Most approval workflows fail because they are slow, so people route around them. The fix is not fewer approvals but cheaper ones: the reviewer should see the draft, the reason it exists and the thing it promises on one screen, and decide in seconds.

That is why we think approval belongs next to memory. A tool that has your meetings, inbox and calendar in one place can show you why an email exists, which promise it closes and whether the slot it offers is really free. A tool that sees only the inbox cannot. And because the person otherwise becomes the glue between disconnected apps, an approval step that arrives with its own context removes work instead of adding it.

The rule we hold to: Otto drafts, you decide. Nothing is sent or finalized without explicit approval.

— Eddie

Run this workflow in Otto

Otto listens in meetings, reads your email and calendar, captures the promises made in any of them into one ledger, and drafts the follow-ups. You approve before anything goes out. You can start on the Free plan at $0 per month, move to Upgraded at $20 per month for higher usage limits, or choose Max at $50 per month. See the plans at ottohq.app.

FAQ

How do I give approval in an email?

Reply with an unambiguous decision that names the version, such as “Approved: version 3, sent to the pricing list.” A bare “looks good” is vague if the draft changes afterwards. If your tool has an approve button, use it, because it records the decision and timestamp for you.

Who should approve an outreach email?

The person with authority over what the email claims or promises. For a sales email that is usually the account owner or a manager, and for a message with legal or pricing content it is whoever owns that topic. Assign a separate person to verify facts if the stakes are high.

What happens if the approver does not respond?

The email stays pending. Silence should never count as permission. Send a reminder, then move to a named backup approver, and pause the send if nobody answers.

Do AI-drafted emails need approval?

Yes, in any case where a wrong send is costly, such as customers, investors, pricing or commitments. The model writes the draft, and a human releases the send. That keeps accountability with a person and gives you a record of who approved what.

Sources