Approval rules for your team

The most common worry about an assistant that does things is a fair one: “What if it sends something wrong to a customer?” The answer isn’t “trust us”. It’s a set of rules you define yourself, and that NEVYLO cannot get around. This guide shows what such a rulebook looks like for a small business.

The three risk classes as the foundation

Every action in NEVYLO has a risk class. Low: internal and reversible (draft, note, moving an appointment internally). Medium: visible to the outside world or only reversible with effort (email to a customer, publishing a post (soon), changing the Google (soon) profile). High: money, deletion, large amounts (quote above threshold, payment reminder, data deletion, payment).

The class is part of the action, not the model’s opinion. Sending an email is always at least medium, no matter how harmless it sounds, because it can’t be undone.

Rule 1: High risk stays with a human

This isn’t a setting but a limit of the system: in every package, high risk needs approval by a person with the right role. All you decide is who that is (the owner alone, or the office manager too) and where the amount threshold sits. €5,000 is a good starting point for trades businesses; law firms often set it lower.

Rule 2: Medium risk by category

Here it pays to differentiate rather than generalise. What’s proven itself: appointment confirmations and reminders automatically (the customer booked the appointment themselves). Replies to standard enquiries (opening hours, prices from the profile) automatically. Quotes, complaints, anything with an individual price: preview. Posts (soon) without a price automatically; with an offer or price: preview. Google (soon) profile syncs automatically when they come from the company profile.

In Starter all of this is preview; from Growth you can set these rules, and Pro lets more complex medium-risk actions run by rule as well.

Rule 3: Keep roles clearly separated

Owner: everything. Admin/office manager: approvals for medium risk and quotes below the threshold. Staff: their own appointments and tasks, drafts, no external approvals. Agency (Enterprise): marketing approvals, no finances. Support: only with justified, logged impersonation.

Every approval appears in the audit log with a name. That isn’t surveillance of staff. It’s protection for them: whoever approved it saw the approval card: What, Why, Where, Data, Cost, Undo, Who.

Rule 4: Categories that never run automatically

Some businesses need hard exceptions. Law firms: no legal statement automatically, not even in a friendly reply. Medical practices: no medical information automatically. Everyone: no reply to a complaint without a preview. You set these exceptions as rules. NEVYLO recognises the category and stops.

Maintain rules, don’t just set them

Start tighter than you think you need to, and loosen up after four weeks based on the audit log: which approvals have you granted a hundred times without changing anything? Those can run automatically. Which ones did you often change? Those stay as previews. That way autonomy grows with trust, not the other way round.

And the kill switch stays: “Stop everything” halts every running task and every automation immediately.