version: 1.0
description: AI Governance Approval Workflow

workflow:

  name: casan_level4_agent_action_approval

  steps:

    - id: STEP-001
      name: Submit Prompt
      actor: developer
      action: submit_prompt
      output: prompt_received

    - id: STEP-002
      name: Security Validation
      actor: system
      action: validate_security
      input: prompt_received
      output: security_checked
      fail_action: block

    - id: STEP-003
      name: Risk Assessment
      actor: system
      action: evaluate_risk
      input: security_checked
      output: risk_level

    - id: STEP-004
      name: Approval Decision
      actor: architect
      condition:
        - if: risk_level == "high"
          action: require_approval
        - if: risk_level == "medium"
          action: optional_approval
        - if: risk_level == "low"
          action: auto_approve

    - id: STEP-005
      name: LLM Execution
      actor: system
      condition: approved == true
      action: call_llm
      output: response

    - id: STEP-006
      name: Audit Logging
      actor: system
      action: log_event
      input: all
      output: audit_record

approval_roles:

  developer:
    can_submit: true
    can_approve: false

  architect:
    can_submit: false
    can_approve: true

  system:
    can_execute: true

rules:

  high_risk:
    required_approver: architect
    timeout: 10m
    default_decision: deny
    non_interactive_override:
      env_decision: CASAN_APPROVAL_DECISION
      env_approver: CASAN_APPROVER

  medium_risk:
    required_approver: optional
    timeout: 5m
    default_decision: auto_approve_with_audit

  low_risk:
    auto_approve: true

notifications:

  on_approval_required:
    channel: log
    message: "Approval required for high-risk action"

  on_denied:
    channel: log
    message: "Request denied"