The Approval Gate Is the Product

There is an assumption running underneath most AI discussion in our industry, and it is worth stating out loud so it can be examined. The assumption is that autonomy is the destination. That today's AI asks permission because it is early, that tomorrow's will not need to, and that the approval step is scaffolding which comes down once the building is safe.

In capital delivery that assumption is wrong, and organisations that build their AI strategy on it will spend the next three years constructing something they cannot use.

The assumption that autonomy is the destination, and that the approval step is scaffolding to be removed once the building is safe, is wrong in capital delivery.

What the demonstrations actually show

Watch closely what happens at the end of an AI action in a well-designed project system.

The assistant drafts a record. It opens in a separate tab, so whatever the user was working on is untouched and nothing in progress is overwritten. The user reviews the fields. Then the user saves, or the user cancels. The system does not save in the background.

Where the AI has prepared updates to an existing record from a source document, those updates stay pending. They are visible, they are ready, and they are not applied until someone commits them. Where the AI identifies a relationship between two records that were not previously connected, it will surface that relationship for analysis and it will not create the link. Creating the link stays a deliberate act by a person.

Read as a limitation, this is a weakness that later releases will remove. Read correctly, it is the only design that survives contact with how capital programmes are actually governed.

Why a programme cannot absorb an unattended actor

A capital programme runs on a delegation of authority. Every commitment, every variation, every certification, every payment release has a named individual behind it who was authorised to make that decision at that value.

The DOA is not administrative decoration. It is the mechanism by which an organisation can say, eighteen months later, who decided this and on what basis.

Introduce an actor into that structure which takes decisions and is not a person, and you have not accelerated the programme. You have put a hole in it.

The consequences do not appear immediately, which is what makes this dangerous. They appear at the first serious dispute, when a party is asked to demonstrate the basis on which a variation was accepted and the audit trail records that it was accepted automatically. They appear at the first audit, when a payment release cannot be attributed to a person authorised to release it. By then the capability has been embedded for two years, and the finding is not about the AI. It is about the organisation's control environment.

The question is not whether the AI is autonomous. It is whether the audit trail still names a person.

The reasonable objection runs like this. If a human still has to approve everything, what exactly was gained? You have replaced typing with reviewing. That is an improvement, but it is not a transformation, and it does not justify the investment.

The objection misidentifies what was scarce.

Approval capacity was never the bottleneck on a capital programme. Senior people can approve a great many things in a day. What they cannot do is work out which of four thousand open records deserves their attention this week. The scarce resource is attention, not authority, and directing attention is precisely what this class of capability does well.

An AI that drafts a change order has saved somebody twenty minutes. An AI that identifies which three of your two hundred open commitments have moved into a position warranting a decision has done something considerably more valuable, and it has done it without taking a single decision itself.

What to look for

When a vendor demonstrates AI capability, the interesting moment is not the output. It is what happens immediately after the output.

Does the action complete, or does it stop? If it stops, what exactly is the user being asked to confirm, and do they have enough in front of them to confirm it responsibly? If the AI has drafted something, can the user see what it was drafted from? If the AI has prepared a change, is it obvious that the change has not yet been applied?

And the question that matters most for anyone who will have to defend the system later: after the user confirms, what does the audit trail say? It should name the person. If it names the assistant, or names nobody, you are looking at a capability that will not survive your first serious dispute.

PMWEB's own buyer checklist for AI, published in September 2026, reduces this to the shortest question on any list of its kind: who signs? AI output should enter the same approval workflow as any other submission, with a named human approver. An AI-drafted pay application review or change order recommendation is actioned only once a named project manager has approved it. A machine-generated forecast, risk flag or summary that takes effect without a person approving it fails the test, however good the output.

The commitment worth understanding

As AI capability in project systems becomes more ambitious, and it will, the property to watch is not how much more it can do. It is whether the gate moves.

Capability that monitors a portfolio continuously, connects an external event to internal exposure and proposes a response is considerably more useful than capability that drafts a form. It is also considerably more consequential when it is wrong. The design commitment that makes the first acceptable is the same one that makes the second acceptable, and it is that the system drafts, prepares and proposes, and a person decides.

That is not a stage on the way to something else. It is the destination.

PMWEB has since written the commitment down. Its Intelligence Control Framework, the governance architecture that sets what AI can access in the platform, how it stays bound by existing permissions and where human judgement stays in the loop, rests on a guiding principle of five words: AI advises, the operator decides. That is the right sentence to hold any vendor to, because it describes where the gate sits rather than how capable the system is.

The system drafts, prepares and proposes, and a person decides. That is not a stage on the way to something else. It is the destination.

Next week: the seven governance questions that stop AI deployments after signature, and what a defensible answer to each of them sounds like.