A content approval workflow for small teams

A content approval workflow decides who can draft, who can approve and who can publish, and what gets checked in between. For a small team, it comes down to three roles, one shared review queue, a short checklist run before every approval, and clear limits on anything that approves itself.

Small teams often skip this because “we all talk anyway.” That works until two people publish different prices in the same week, or an AI draft goes live with a made-up statistic. The workflow below takes a few minutes per post and prevents both.

Why approval matters more with AI drafts

AI tools changed the bottleneck. Drafting used to be the slow part. Now a team can produce more drafts in a day than it can read carefully. Review is where quality is won or lost.

Google’s guidance on helpful, reliable content asks whether content is “written or reviewed by an expert or enthusiast who demonstrably knows the topic well.” For most small businesses, that expert is someone on the team. The approval step is where their knowledge reaches the page.

Approval also limits risk from automation. The OWASP guidance on excessive agency in AI systems recommends human-in-the-loop control “to require a human to approve high-impact actions before they are taken.” Publishing to your public site is a high-impact action.

The three roles a small team needs

You don’t need an org chart. You need three levels of access, and a clear answer for who holds each one.

Role	Can do	Can’t do	Typical person
Owner	Everything an editor can, plus team, billing, publishing destinations, automation settings and taking pages down	Nothing withheld	The founder or the person accountable for the site
Editor	Draft, revise, comment, approve and publish	Change team, billing or automation settings	Marketers, writers, subject experts
Viewer	Read drafts and comment	Draft, approve or publish	Advisers, legal, a client who signs off informally

A few rules make the roles work:

• Keep owners few. One or two people. Every extra owner is another person who can change settings that affect everything.
• Give the subject expert approval rights. If your head chef knows the menu, make them an editor, not a viewer whose comments get lost.
• Use viewers for sign-off outside the team. A lawyer or client can comment on a draft without being able to publish it.
• Keep at least one owner active. When someone leaves, check who still has owner access before you remove them.

How to run one review queue

A review queue is one list of everything waiting for a decision. The point is that nothing sits in someone’s inbox where only they can see it.

1. Every draft enters the same queue. Whether a person, an AI tool or an agent started it, it lands in one place marked “ready for review.”
2. Assign a reviewer. Pick one named person per draft. “The team will look at it” means nobody will.
3. Set a turnaround you can keep. Agree on how long a draft may wait, and look at the queue on a fixed day if volume is low.
4. Decide in one of three ways. Approve it, request changes and revise, or request changes and leave it for a person to edit.
5. Keep discussion on the draft. Comments attached to the draft survive. A chat thread about “the Tuesday post” doesn’t.
6. Approve the exact version. An approval belongs to one version. If anyone edits after approval, the new version needs approval again.

That last rule closes the most common gap. A post gets approved, someone “just fixes a typo,” and a changed price goes live unreviewed.

What to check before you approve

Use the same checklist for every post. Automated checks can handle some of it; a person still owns the decision.

1. Facts. Every number, date, price and quotation has a source or comes from your own records. No unresolved errors from any automated check. Our guide to fact-checking AI drafts claim by claim covers the method.
2. Your own details. Prices, hours, offers, product names and policies are current. AI tools are most often wrong about the things only you know.
3. Claims with legal weight. Health, finance, safety, guarantees and comparisons with competitors get extra care, or a second reviewer.
4. Voice. It sounds like you, uses your terms, and avoids words your brand doesn’t use.
5. Links. Internal links point to live pages. External links support the sentences they sit on.
6. Title and description. They are accurate, specific and match the article.
7. Images. You have the right to use them, they show what the text says, and they have useful alt text.
8. Destination and timing. It goes to the right site or channel, on the right date, as a draft or live as intended.

If a draft fails on facts, send it back. If it fails on voice alone, an editor can often fix it faster than a revision.

How AI agents fit into approval

Many teams now connect an assistant like ChatGPT, Claude or Grok to their content tools. Agents are good at planning, drafting and following up. They should not approve their own work.

The Model Context Protocol, the standard most assistants use to connect to tools, takes the same view. Its tools specification says there “SHOULD always be a human in the loop with the ability to deny tool invocations.”

A safe split looks like this:

• Agents may plan the calendar, commission drafts, answer the draft’s questions, request revisions, comment and assign reviewers.
• People must approve drafts, take pages down, change team access and billing, and post anything that can’t be taken back, like a social post or an emailed newsletter.
• Agents may publish an approved version to a website, because a person already approved it and a page can be updated or withdrawn.

Our guide to connecting AI agents to your content workflow goes through this model in detail.

When auto-approval is safe

Auto-approval means the system approves some drafts without a person. It is safe only when every input was chosen by a trusted person and every check passed. Treat it as an exception an owner grants, not a default.

These conditions make it safe enough for routine posts:

1. An owner turns it on, in person. Not an editor, not an agent, not an API key. Turning it on is recorded, and every owner is told.
2. It covers only planned posts. The subject came from a calendar a person wrote, not from an agent or an automated import.
3. Every input is trusted. If an agent changed the plan item, answered the draft’s questions, or edited a document the draft relied on, the draft goes to a person instead.
4. There are zero blockers. Any unresolved factual error stops it. One automatic revision to fix blockers is reasonable; after that, a person decides.
5. The approved content is the checked content. The version is locked to what passed the checks, so nothing changes in between.
6. The approver stays accountable. The approval is recorded under the owner who turned it on. If that person stops being an owner, auto-approval stops.

Situation	Approve by hand	Auto-approval can be safe
A new site, or a voice you haven’t settled	Yes	No
Health, legal, financial or safety topics	Yes	No
Posts with prices, offers or deadlines	Yes	Only if the facts come from your own documents
Social posts and emailed newsletters	Yes, always	No: they can’t be taken back
Routine planned articles after a few weeks of clean reviews	Either	Yes, with the conditions above
Drafts an agent requested or changed	Yes	No

Even with auto-approval on, keep reading a sample of what goes out. If you find problems the checks missed, turn it off and fix the checks first.

How to take a page down

Every approval workflow needs an exit. Decide in advance who can withdraw a published page, and how. In most teams that is an owner. Write down what happens at each destination, since some platforms delete a post and others can only unpublish it.

How Wavefront handles approval

Wavefront builds this workflow in. Workspaces have owner, editor and viewer roles. Drafts arrive in one queue on the review screen, where you can assign a reviewer, comment, approve or request a revision. Approval happens only in the web app, by a signed-in owner or editor, and it applies to one exact version. Each draft shows the results of the checks run on every draft, and a draft with blockers can’t be approved.

Connected agents can plan, draft and request revisions, and publish versions a person approved, but they can’t approve. Social posts and newsletter sends stay with a person. Wavefront’s autopilot can draft calendar posts on its own. Auto-approve is off by default, and an owner turns it on in the web app under the conditions listed above. Our help article on autopilot and auto-approve has the details, and the security overview covers roles and access.

Sources

1. Google Search Central: Creating helpful, reliable, people-first content
2. OWASP GenAI Security Project: LLM06 Excessive Agency
3. Model Context Protocol specification: Tools (user interaction model)