Approvals and reviews
Who may approve what, separation of duties, escalation, and reviewing what AI agents propose before it is applied.
contentworker has two kinds of review, and both come down to a person with the right permission saying yes or no:
- an approval in a workflow: a step that waits for a decision on an entry before the workflow continues;
- an agent review: an AI proposal (new field values, tags, a translation) waiting to be applied or discarded.
Approvals
Section titled “Approvals”The control.approval node waits for a decision and leaves
on one of three branches: approved, rejected, or escalated when nobody decides in time.
Approval nodes run inside workflow runs, which are rolling out; stage gates
and agent reviews, below, work today.
| Setting | What it does |
|---|---|
| Who may decide | The scope a person needs to approve or reject. The default, workflow:approve, lets the Approver role and up decide; content:write lets editors decide; content:publish keeps the decision with publishers. |
| Separate duties | Whoever started the run can’t decide it, so nobody approves their own work. |
| Escalate after | A duration such as 2 days; then the escalated branch is taken. |
| Assignee | Who the approval is addressed to, shown in the approvals inbox. |
| Instructions | What the reviewer should check, shown with the request. |
Chain approvals for multi-step sign-off. The built-in
Editorial review template asks an editor
first, then legal only for entries tagged legal, with separation of duties on the legal step.
Approvals are decided in the admin, over the API or by an agent through MCP, always with the
decider’s own permissions: an agent holding a key without content:publish can’t approve a step
that needs it.
Stage gates
Section titled “Stage gates”A workflow stage is a lighter gate: moving an entry into a stage needs that stage’s scope, so “Approved” can be reserved for people who may publish.
Agent reviews
Section titled “Agent reviews”When an AI agent produces a change that isn’t set to apply on its own, it is saved as a pending agent review: the proposed field values, the agent’s notes on why, and the entry they’re for. Nothing touches the entry until someone decides.
- Approve applies the proposal as a new draft version, through the same validation as a human edit. It is applied exactly once, even if two reviewers click at the same moment.
- Reject discards it; nothing is applied.
| Do this | API | MCP tool | Scope |
|---|---|---|---|
| List pending | GET …/agent-reviews?status=pending |
agent_review_list |
preview:read |
| Approve | POST …/agent-reviews/{id}/approve |
agent_review_approve |
content:write |
| Reject | POST …/agent-reviews/{id}/reject |
agent_review_reject |
content:write |
An approved proposal lands as a draft, so a reviewer who may write but not publish can accept it, and someone who may publish decides when it goes live.
Moderation holds
Section titled “Moderation holds”The moderation agent classifies an entry’s text and, when it flags something, records a hold
with the categories it found. A hold is a record for people to act on, not an automatic unpublish;
a workflow can branch on the result (see ai.moderate) to route
flagged entries to a person before they publish.