Flowgrammer

Document Approval Workflow

App-neutral document approval with named authority, version-locked decisions, reminders, and one idempotent handoff after approve.

— Craig Major

What a document approval workflow is

A document approval workflow is a controlled path from intake to a named decision. It registers the file and version, names a requester and an authorized approver, records approve, reject, or request-changes, keeps evidence, and then performs at most one idempotent downstream action. A person still decides. Comments, reactions, and a status field are not enough.

Start with Document Processing Automation if you still need to decide what to automate first.

Who this is for

Use this when more than one person must sign off, reminders matter, versions collide, or a later system should update only after a named approve.

Prerequisites:

  • One document family for the first build
  • A durable file identity and version id or content hash
  • Named approvers, not a shared inbox
  • A written sequential or parallel rule
  • Fictional or approved samples before any live write

Leave these out of the first system: anonymous approval, high-confidence auto-release, payment, final accounting posts, supplier bank-detail changes, e-signature as a substitute for internal approval, and any claim that a retention label certifies compliance.

If the pain is still "we cannot read the PDF," start with intelligent document processing. Confidence can send a file to review. It cannot approve.

If the job is an invoice register, use the invoice tracker. A tracker can show pending review. It is not this control system.

How common tools fit

Choose each tool for the job it actually does.

Tool Fit Limit
SharePoint Library content approval, metadata, versioning, and ModerationStatus Content approval is one pattern. It does not replace an authority matrix. See SharePoint document processing for the library how-to.
Google Drive Native Approvals with IN_PROGRESS, APPROVED, DECLINED, CANCELLED; all reviewers must approve; a new version can reset approval Edition and admin gates apply. Labels are metadata, not a decision log.
Notion Database buttons and automations can set Status, person, and a timestamp Builder pattern. Not a native Approvals object or immutable audit.
Slack Workflow Builder branches and buttons can collect a response Plan-gated. Treat Slack as a notification surface, not the system of record.
Power Automate Start and wait for an approval; sequential, everyone-must, and first-to-respond types Orchestration. For approvals that may exceed 30 days, use Microsoft’s documented Dataverse long-running pattern.
n8n Wait and approve steps inside a workflow Orchestration, not a document UI. See n8n document processing.
Dropbox / Box File storage, versions, and sharing Keep decisions in an explicit evidence log. Comments and shared links alone do not prove an authorized approval; e-signature remains a separate job.
E-sign tools Signing order and recipient execution Internal approval is not a signature. A file may need both, in sequence.
Document AI Extract fields and confidence Extraction is upstream. It does not release the record.

monday.com marketplace approval apps are not treated as native product proof here. ClickUp timesheet Approvals are a different feature from document review.

Worked example

Cedar & Quay Fabrication Ltd is a fictional Toronto fabricator. Quality owns supplier procedure DOC-CQ-PROC-014. Version 1.3 is the candidate. Sequential review: Ops Manager, then Quality Lead. After Approve, copy the locked file into a controlled folder once.

That clean path is case 1 in the Document Approval Status and Role Matrix. The other six cases reuse the same document.

Invoice-specific approval still sits on invoice processing automation and accounts payable automation. Those paths stop at a reviewed draft bill. They do not pay vendors.

The approval workflow

  1. Intake. Register source channel, received time, owner, and a pointer to the file. Do not write a destination on intake alone.
  2. Identity. Store document_id, version_id, and a content hash or ETag. Refuse submit if identity is missing.
  3. Assign. Name the requester and the authorized approver for this document type and step.
  4. Route. Sequential waits for the previous step. Parallel needs an explicit everyone-must or first-to-respond rule.
  5. Decide. Capture decision_id, actor, time, comment, and the version that was seen. Approve, reject, or request-changes.
  6. Remind and escalate. Remind before due. After timeout, escalate, reassign, or cancel. Timeout does not approve.
  7. Invalidate stale versions. If the file changed, void the open decision and start a new cycle on the current version.
  8. Stop duplicates. A second request for the same document and version is duplicate. A second response for the same decision_id is ignored.
  9. Handoff. After Approve, run one agreed downstream action. Retry with the same idempotency key. Write count stays 1.
  10. Evidence. Keep an exportable decision log. Chat messages and emoji reactions are not the audit trail.

Sequential versus parallel

Policy What happens Use when
Sequential Step 2 cannot start until step 1 decides Ops must see the file before Quality
Parallel, everyone must approve One decline can finish the cycle as rejected Several named reviewers share authority
Parallel, first to respond The first valid decision wins Coverage, not layered authority
Threshold / risk Document type or risk selects the path Customer-facing or regulated procedures

Microsoft documents sequential Approval types and everyone-must versus first-to-respond. Google Drive Approvals require every reviewer and treat one decline as declined. Those are vendor illustrations, not a requirement that every SMB buy those products.

What can run automatically, and what cannot

Situation Automatic action Person required
Request registered with version identity Yes No
Required fields missing Stay draft or exception Owner completes identity
Authorized approver chooses Approve Status approved; one handoff The decision itself
Request-changes Status changes_requested; prior step approvals void on the new version Owner revises
Actor not in the matrix Exception unauthorized_approver Process owner reassigns
Decision cites an old version Exception stale_version Restart on the current version
Second request for the same version Status duplicate Continue the canonical request
Destination timeout after Approve Retry the same key Confirm the existing DownstreamRef
Reviewer cannot open the file Exception missing_access Restore access or reassign
SLA missed Reminder, then escalate Escalation approver. No auto-approve
Payment or bank-detail change Never Entirely outside

Human gates

A person keeps these decisions:

  • Approve, reject, or request-changes
  • Authority and self-approval conflicts
  • Stale-version restarts
  • Duplicate versus canonical request
  • Missing or expired access
  • Escalation after timeout
  • Payment release and any supplier bank-detail change

A confidence score can send a document to review. It cannot approve. It cannot sign. It cannot pay.

Failure paths

Failure Expected status Downstream Payment
Unauthorized actor in_review + unauthorized_approver No write Blocked
Stale version stale_version No write Blocked
Duplicate request duplicate No second write Blocked
Replayed decision_id Ignore replay Write count stays 1 Blocked
Destination timeout Retry same key Write count stays 1 Blocked
Expired or missing access missing_access No decision yet Blocked
Timeout with no person pending_escalation No auto-approve Blocked
Any payment or bank-detail change Forbidden Forbidden Forbidden

Test cases

The seven Cedar & Quay cases are control fixtures. They do not measure OCR.

Case Input Without a named approver After the control
Clean DOC-CQ-PROC-014 v1.3 in_review, 0 writes Sequential Approve → one DownstreamRef
Request changes Quality asks for a revision note changes_requested Owner files v1.4; new cycle
Unauthorized Finance clerk clicks Approve Exception unauthorized_approver Status stays in_review
Stale version Decision cites v1.2 after v1.3 Exception stale_version Restart on v1.3
Duplicate request Second open request, same version duplicate Canonical request continues
Lost downstream Timeout after Approve approved, retry Two attempts, write count 1
Missing access Expired sharing link Exception missing_access No decision until access is restored

The Document Approval Status and Role Matrix walks each case on its own sheet.

What to measure

Record requests received, time to first decision, on-time rate, escalation count, unauthorized attempts, stale-version voids, duplicate stops, destination attempts, destination writes, and open exception age. Put your numbers in the matrix. Keep them as operational counts, not as a savings or compliance-percentage result.

There is no live production approval metric here, and no Flowgrammer customer approval case.

How to use the matrix

The paired asset is an editable workbook, not a marketplace template and not an e-sign kit.

  1. Open Instructions and read the e-sign, IDP, and payment separations.
  2. Confirm the shared field list and the closed status model.
  3. Fill RolesAuthority. Named approvers only. Block self-approve when the SoD flag is on.
  4. Choose sequential or parallel and write the timeout outcome. Timeout is escalate, reassign, or cancel.
  5. Walk Case01 through Case07.
  6. Answer the security and retention questions. Labels alone are not a records program.

SharePoint library schema work stays on the SharePoint library schema. Do not replace this matrix with a SharePoint-only workbook.

Realistic limitations

  • A status field, a comment, or a reaction is not secure decision evidence.
  • Builder patterns in Notion or Slack are not immutable audit logs.
  • Classic SharePoint content approval and modern Approvals can differ by tenant.
  • Drive Approvals are limited to eligible Workspace accounts, and edits can reset approvals when reviewers must approve the same content.
  • Dropbox and Box can store versions and share files; keep authorization and decision evidence in an explicit log.
  • This system does not sign a document, pay anyone, or change supplier bank details.
  • This guide does not rank vendors, and it is not a Microsoft, Google, Slack, or DocuSign product walkthrough.

Next step

Download the Document Approval Status and Role Matrix and fill the roles, routing rule, and seven cases.

If reviewers, authority, or the downstream action are still unclear, start with an AI Success Audit. If those pieces are already named, book a fit call to scope an AI Automation Systems build.

Sources

Frequently asked questions

What is a document approval workflow?

It is a controlled path from intake through a named approve, reject, or request-changes decision, with version lock, evidence, and at most one idempotent downstream action.

Is document approval the same as e-signature?

No. Internal approval is an organizational decision. E-signature is recipient execution. A document may need both, in that order.

Can high-confidence extraction auto-approve a file?

Not as default advice. Confidence can route a file to a person. A named approver still decides.

Is Slack enough as the system of record?

Usually no. Slack can collect a response. Keep the decision log and the file identity in a system you can export.

Does SharePoint content approval cover the whole job?

Only part of it. Library moderation can hide pending files. It does not replace named authority, stale-version rules, and an idempotent handoff. See the SharePoint document processing guide for the library pattern.

When is a tracker not enough?

When several reviewers, reminders, version conflicts, or a downstream write after approve appear. Those signals already appear in an invoice tracker for invoice workflows. This guide is the general control system.