Smart Approvals

Intended audience: System administrators and Amazon Quick administrators

Important

Smart Approvals is available in the Amazon Quick desktop app and mobile app. It is not currently available in the web version.

How Smart Approvals works

When an agent proposes an action on a user's behalf – such as sending email, updating a record, or creating a ticket – Smart Approvals reviews the action and decides whether it can proceed automatically or needs the user's approval. Smart Approvals reviews only the actions that your existing controls already make eligible for automated review. It does not grant new access or change what a user is permitted to do.

Quick evaluates each proposed action in the following order:

1. Quick checks the action against your existing controls: permissions, custom permissions, guardrails, connector action permissions, and the user's own settings. Actions that your policies deny stay denied. Actions that your policies require a person to approve always go to the user.

2. For an action that is eligible for automated review, Smart Approvals evaluates it against the user's request and the conversation. If the action is low-risk and consistent with what the user asked for, Smart Approvals approves it and Quick labels the automatic approval in the conversation.

3. If the action is consequential – for example, it sends content outside the organization, changes permissions, deletes or overwrites content, or initiates a payment – Smart Approvals refers it to the user for review. Review failures, such as timeouts, also go to the user.

Note

Automated review reduces prompts for eligible actions, but it is not a substitute for policy. For any action that must always receive human approval, consider requiring review through connector action permission settings rather than relying on automated review.

Which actions Smart Approvals reviews

Whether Smart Approvals reviews an action depends on the connector's Action permissions setting for that action. Smart Approvals reviews an action only when both of the following are true:

• The connector author set the action to Let user choose.

• The user's permission for the action is Ask each time.

In all other cases, the action follows its configured Action permissions setting directly and is not reviewed by Smart Approvals first. For example, an action that the connector has set to Always Allow proceeds without review, and an action that is set to Always Ask goes to the user for approval.

Enabling or disabling Smart Approvals for users

Smart Approvals is on by default for all users. As an administrator, you control whether users can use Smart Approvals with custom permissions profiles. When you restrict the Smart Approvals feature in a profile, users assigned to that profile cannot use Smart Approvals, and their eligible actions go to a person for review. For more information about custom permissions, see Custom permissions.

To enable or disable Smart Approvals in a custom permissions profile

1. Open the Quick console.

2. Choose Manage Quick.

3. In the left navigation, choose Permissions, and then choose Custom permissions.

4. Create a new profile, or locate an existing profile and choose Edit.

5. In the Capabilities & features section, expand AI capabilities.

6. Set the Smart Approvals feature:

   • To disable Smart Approvals for users assigned to this profile, restrict the feature.

   • To enable Smart Approvals, leave the feature unrestricted.

7. Save the profile, and assign it to the users, roles, or account as needed. For more information, see Assigning custom permissions profiles.

Turning Smart Approvals on or off as a user

If your administrator allows Smart Approvals for you, you can turn it on or off for yourself from the chat menu. This is a global setting: it applies to all of your conversations and to actions that your scheduled runs take on your behalf.

To turn Smart Approvals on or off

1. In chat, choose the + icon to open the chat menu.

2. Turn Smart Approvals on or off.

Note

When you turn Smart Approvals off, your eligible actions need your review instead of being approved automatically. Because the setting is global, turning it off also affects the eligible actions that your schedules take on your behalf: those actions wait for your review rather than proceeding automatically.

Auditing Smart Approvals activity

Amazon Quick records Smart Approvals activity in AWS CloudTrail. CloudTrail records each action that Smart Approvals approves and each change that a user makes to their Smart Approvals setting. Each review event identifies the user, the agent, the connector and action, and the time. All Smart Approvals events use the event source quicksight.amazonaws.com.

Changes to a user's Smart Approvals setting

When a user turns Smart Approvals on or off, CloudTrail records a BatchUpdatePreferencesInternal event. In this event, scope is set to USER and scopeId identifies the user. The preferenceKeys field is set to UseSmartApprovals. The updatedValues field shows the new setting: ON when the user turned Smart Approvals on, and OFF when the user turned it off.

Actions that Smart Approvals approved

When Smart Approvals approves an action, CloudTrail records a BatchUpdatePermissionsInternal event. In this event, the connectorId and actionId fields identify the connector and the action – for example, jira and jira_create_issue. The approvalSource field is set to SMART_APPROVALS.

Note

An event with approvalSource set to SMART_APPROVALS shows that Smart Approvals approved the action. It does not confirm that the action ran.