Before
A reviewer opened or prepared a case, copied the assessment recommendation and supporting details, and contacted each security and privacy decision maker separately. The application status and approval records also had to be maintained as separate handoff activities.
How it works
- Receive the AI assessment, assemble the review details, assign risk-based priority, and identify the security and privacy approvers.
- Create the review and one requested approval record per approver, with the recommendation prefilled as the initial decision.
- Deliver each approver a tailored summary, update the application registry to under review, and leave the final decision to the named human approvers.
Workflow details
- Assessment intake: The workflow starts when an AI application assessment is submitted with the application name, registry identifier, risk details, recommendation, data classification, rationale, evidence, and optional usage information.
- Review preparation: It converts the assessment into a review summary, maps risk level to priority, preserves the recommendation as the initial decision, and identifies the configured security and privacy approvers.
- Record creation: A review record is created with the application, risk score, recommendation, data level, rationale, and requested approval status. A separate requested approval record is then created for each approver.
- Approver notification: Each approver receives a decision request containing the tool, vendor, usage, risk score, recommendation, data classification, rationale, key facts, and a link to open the review. The decision can be edited before approval.
- Registry handoff: After the review and approvals are prepared, the related application registry entry is updated to an under-review status, leaving the security and privacy decisions with the named human approvers. The demonstration uses synthetic integration responses for the displayed operations.
What changed
Each assessment now creates one structured review and separate requested approvals for the configured security and privacy approvers, with risk, recommendation, evidence, and usage details carried forward automatically. Notifications and the under-review registry update occur as part of the same workflow, while the actual approval decision remains human-controlled.
Work removed
Creating duplicate approval records, copying assessment details into separate requests, addressing each approver manually, sending repeated summary messages, and manually updating the application registry to show that review has started.
Expected outcome
For the configured two-approver process, one assessment produces one visible under-review record, two requested approval records, and two corresponding notifications without duplicating the preparation and routing work.
