The request
{
"name": "wever_approval-policy-check",
"arguments": {
"approvals": {
"approvers": [
"CFO"
],
"checked": "at_execution",
"raises_limit": false
},
"policies": [
{
"name": "Vendor payment limit",
"limit": "5,000 USD",
"scope": "per_action",
"changed_by": [
"Finance committee"
]
}
],
"conflict_rule": "latest_wins",
"exception": {
"approvers": [
"Finance committee"
],
"recorded": false,
"single_use": true
},
"paths": [
{
"name": "Payments API",
"checks_policy": true
},
{
"name": "Manual wire",
"checks_policy": false
}
]
}
}What the report returns
Verdict: approval_overrides_policy.
| Override, latest wins | The later instruction governs, and an approval always comes after a limit set in advance, so the approval governs. Nothing records which limit it lifted. |
|---|
| Override, unrecorded exception | Finance committee may approve above a limit, and the exception is not recorded with the limit it lifts, so the override leaves no trace. |
|---|
| Override, unchecked path | The Manual wire path executes approved payments without checking the standing limits. |
|---|
| Fix, latest wins | Make the standing limit govern every conflict, and route a payment above it through a named exception path. |
|---|
| Fix, unrecorded exception | Record each exception with the approver, the limit it lifts and the action it covers. |
|---|
| Fix, unchecked path | Check the standing limits on the Manual wire path before execution. |
|---|
3 ways approving in the moment overrides policy set in advance: latest wins, unrecorded exception and unchecked path.
The CFO approves a 10,000 USD vendor payment. The finance committee set a 5,000 USD limit per payment in advance. Under a latest-wins rule the approval governs, because an approval always comes after a limit set in advance, and the exception leaves no record of the limit it lifted. The manual wire path never checks the limit at all. Making the standing limit govern every conflict, recording each exception with the limit it lifts and checking the limit on every path keeps the policy in force.