Amazon's AI assistant now skips routine approvals, but not risky ones

Amazon has added a feature called Smart Approvals to Amazon Quick, its AI assistant for work. Instead of asking a person to click "approve" on every step, it can approve routine actions on its own. Anything that looks consequential goes back to the user. The goal is fewer pointless prompts, so people pay attention to the ones that matter.

What changed

AI assistants often handle tasks with many steps, and each step can trigger an approval prompt. Amazon points to research showing that people pay less attention to security warnings the more often they see them. Smart Approvals is meant to cut the noise without cutting oversight. A separate AI model, called the classifier, reviews each proposed action against what the user actually asked for.

What it can and cannot approve

The feature only applies when a user's setting is "Ask each time" and no other rule requires a person. Denied actions stay denied. Required human approvals still apply. The classifier weighs what the action does, where data goes and who it affects. Some examples can still go back to a person:

• Sending content outside the company or to senior leaders in the user's reporting chain
• Changing who has access to something
• Deleting records
• Starting payments

Amazon says that list is not complete, and the classifier also looks at the surrounding context.

A real-world example

Amazon describes an account manager who asks Quick to write a client brief and send it to two named colleagues. If a note in her files says to also send it to an all-sales list of about 2,000 people, the audience has changed. Smart Approvals is designed to return that send to her so she can decline it. Approval for the first two recipients cannot be reused for the larger group.

Limits to know about

Each automatic approval works once, for the exact action reviewed, and grants no lasting permission. Timeouts and review failures never count as approval. Amazon also says the model can make mistakes. Its own guidance is that actions that must always get human sign-off, including those that move sensitive data, should be required through connector action permissions, which are rules set when a connector is created.

Control and records

Administrators decide who can use Smart Approvals. It is on by default, but profiles that deny everything by default must allow it explicitly. Users can switch it off for themselves. Permission changes tied to the feature are logged in AWS CloudTrail, a record-keeping service. Its Event history keeps events for 90 days, so longer investigations need a configured trail.