It depends on what is being approved and how the decision rules are controlled. Low-risk, well-defined requests may fit a documented rule, while unusual or sensitive changes may need a person. Identify who owns the rule, how exceptions are handled, and how changes to the rule are approved. Keep records showing which version made each decision. Test representative normal, exception, and rejection cases before rollout, and review unexpected outcomes afterward. An automatic approval that simply accepts every request removes the review rather than improving it. Discuss the intended control design with the auditor before replacing an established human approval.
Related: User access reviews.
Further reading: NIST automated control-assessment guidance; NIST access-control guidance.
