Approval Matrix Template: Thresholds, Approvers, and Authority Limits for AI Agents
By Kirill Stolbushkin
Short answer: An approval matrix is a table that says who approves which requests at which amounts. A useful one has five core columns: request type, threshold, approver, backup and deadline. Copy the template below, fill in your own numbers, and keep one matrix for the whole company instead of a different version in every team. If AI agents touch any of these requests, add a sixth column for what the agent may do on its own.
What is an approval matrix?
An approval matrix is a table that maps each type of request and amount to the person who must approve it.
Before the detail, who's writing: I'm Kirill, cofounder of Vevos. Approval rules like these are the raw material for the playbooks we build, so I've read a lot of matrices, good and bad. The template here is plain enough for a spreadsheet. If you'd rather see your approval flow as a diagram, the free mapper at vevos.ai/free draws one from a description, no sign-up.
A matrix answers three questions fast: does this need approval, who approves it, and what happens if they're away. Without one, approvals go to whoever is nearest, and finance finds out later. You'll also hear it called an authority matrix or an authorization matrix.
Approval matrix template (copy this)
Here's a general approval matrix template you can copy into a spreadsheet or doc and edit.
Request type | Threshold | Approver | Backup | Deadline | AI agent may do alone |
|---|---|---|---|---|---|
Purchase requisition | Up to $1,000 | Team lead | Department head | 1 business day | Approve up to $250 within budget from a listed vendor |
Purchase requisition | $1,000 to $10,000 | Department head | Finance manager | 2 business days | Check budget and prepare a summary |
Purchase requisition | Over $10,000 | Department head, then finance manager | Controller | 3 business days | Prepare the summary only |
Customer refund | Up to $100 | No approval needed | Same day | Issue the refund | |
Customer refund | $100 to $1,000 | Support lead | Support manager | 1 business day | Prepare the case summary |
Customer refund | Over $1,000 | Finance manager | Controller | 2 business days | Prepare the case summary only |
Sales discount | Up to 10% on deals under $20,000 | No approval needed | Same day | Approve | |
Sales discount | 10% to 20% | Sales manager | Head of sales | 1 business day | Prepare the deal summary |
Sales discount | Over 20%, or any deal over $100,000 | Finance manager | Head of sales | 2 business days | Prepare the deal summary only |
Work order | Up to $2,500 | Facilities lead | Operations manager | 1 business day | Approve up to $500 for listed contractors |
Work order | Over $2,500 | Operations manager | Finance manager | 2 business days | Collect quotes and prepare a summary |
New vendor setup | Any | Procurement lead | Finance manager | 2 business days | Check documents; no setup without approval |
All amounts are placeholders. Set yours from your budget, your risk appetite and how fast the business needs to move. Process-specific matrices for AP, expenses, hiring, IT access and contracts are further down.
How to create an approval matrix (step by step)
Build the matrix one request type at a time, starting with the requests that happen most often.
List request types. Start with purchases, invoices, refunds and expenses. Add the rest later.
Set thresholds. Use round numbers and two or three levels per request type.
Name roles, not people. Write "AP lead", not a name, so the matrix survives a reorg.
Add a backup for every approver. Approvals stall when the one approver is out.
Set a deadline and an escalation. Say what happens when it passes: the request goes to the backup. Never auto-approve.
Check segregation of duties. The requester can't approve their own request, and whoever approves a payment shouldn't be the one who set up the vendor.
Fill in the AI agent column, if you use agents. Keep every agent limit below the lowest human approval level.
Get sign-off and set a review date. Have the CFO or controller approve it, and review at least yearly.
How to build it in Excel or Google Sheets
An approval matrix works fine in a spreadsheet if you lock the structure and keep one shared copy.
One row per request type and threshold band, with the same six columns as the template.
Dropdowns for roles. Put your list of approver roles on a second tab and use data validation, so nobody types "Fin Mgr" in one cell and "Finance manager" in another.
A lookup for routing. To find the approver for an amount in cell B2, a formula like =IFS(B2<=1000,"Team lead",B2<=10000,"Department head",TRUE,"Finance manager") works in both Excel and Google Sheets.
Freeze the header row and protect the sheet, so only finance can change thresholds.
A change log tab with date, what changed, and who approved it.
A spreadsheet tells people the rule. It doesn't make anyone follow it; that's where a mapped process comes in.
How to set thresholds
Set thresholds so that most requests by count go to the lowest level and most money by value gets a senior look.
A practical method: pull last year's requests, sort by amount, and set the first threshold where it catches most of the small, routine items. Then set the top threshold where the amounts become material to your budget. The ranges below are illustrative starting points, not benchmarks; adjust to your own data.
Company size | First level (manager approves up to) | Second level (department head up to) | Above that |
|---|---|---|---|
Under 50 people | $500 to $1,000 | $5,000 | Founder or CEO |
50 to 500 people | $1,000 to $2,500 | $10,000 to $25,000 | Finance manager or CFO |
Over 500 people | $2,500 to $5,000 | $25,000 to $100,000 | CFO, with board limits from the delegation of authority |
Approval matrix examples by process
Each process uses the matrix differently, so here are small matrices for six common ones.
Purchase requisitions
Amount | Approver | AI agent may do alone |
|---|---|---|
Up to $1,000 | Team lead | Approve up to $250 within budget |
$1,000 to $10,000 | Department head | Check budget, prepare summary |
Over $10,000 | Department head, then finance manager | Prepare summary only |
Watch for split orders, such as three $900 requests to stay under a $1,000 limit. Our purchase requisition approval process guide covers the full flow, and the procurement process guide shows where it sits.
Accounts payable approval matrix
Invoice situation | Approver | AI agent may do alone |
|---|---|---|
Matched to PO and receipt, within 2% | No approval needed | Queue for payment |
Mismatch over 2% | AP lead, then AP manager after 1 day | Prepare the difference and a recommendation |
No purchase order | Budget owner | Route to the budget owner |
Over $25,000, any situation | Controller | Prepare summary only |
Our invoice approval workflow goes deeper on the AP side.
Expenses
Expense | Approver | AI agent may do alone |
|---|---|---|
Within policy, up to $500 | Direct manager | Check receipts and policy, flag gaps |
Over $500 or outside policy | Department head | Prepare summary |
Travel over $2,500 | Department head before booking | Prepare summary only |
Hiring and headcount
Request | Approver | AI agent may do alone |
|---|---|---|
Backfill within budget | Department head | Prepare the request from the role description |
New role within budget | Department head and finance manager | Prepare the request |
New role outside budget | CFO and CEO | No action |
Keep a person on every hiring decision. AI used in employment decisions is a high-risk area under the EU AI Act.
IT access
Access | Approver | AI agent may do alone |
|---|---|---|
Standard tools for the role | Direct manager | Prepare the setup request from the role's standard list |
Sensitive data or finance systems | System owner | Prepare the request |
Admin rights | IT security lead | No action |
Contracts
Contract | Approver | AI agent may do alone |
|---|---|---|
Standard terms, up to $25,000 a year | Department head | Compare with standard terms, flag changes |
Non-standard terms | Legal counsel | Flag the clauses |
Over $25,000 a year | Department head, legal, then CFO | Prepare summary only |
Work orders follow the same pattern; see the work order process.
Approval matrix vs delegation of authority matrix
A delegation of authority matrix is the company-wide document that says which roles can commit the company to what, and an approval matrix is the working table that applies it to daily requests.
Delegation of authority matrix | Approval matrix | |
|---|---|---|
Scope | The whole company, often approved by the board | One or more processes |
Covers | Spending, contracts, hiring, legal commitments | Day-to-day requests like purchases, invoices and refunds |
Changes | Rarely, with formal approval | When processes or limits change |
Used by | Leadership, finance, legal | Every requester and approver |
Your approval matrix should never allow more than the delegation of authority does.
Approval matrix vs RACI
A RACI chart says who is responsible, accountable, consulted and informed for a task, while an approval matrix says who must say yes at which amount.
RACI chart | Approval matrix | |
|---|---|---|
Answers | Who does what in a process | Who approves which request at which amount |
Based on | Tasks and roles | Request types and thresholds |
Typical use | Projects and process design | Spending, payments and commitments |
Use both. The RACI names the accountable owner; the matrix sets their limits. Our post on process ownership and RACI covers the first half.
Approval matrices and SOX controls
If your company is subject to SOX, approval thresholds are often key controls, so the matrix becomes part of your control documentation.
Auditors usually want to see the rule, evidence that it was followed, and that the approver had the authority. A clear matrix plus a process map showing where each approval happens makes that conversation shorter. Our post on SOX internal controls documentation covers what to document. Your auditor decides what counts as evidence.
How to add AI agents to the approval matrix
Add AI agents as their own column, with an authority limit per request type that sits below the lowest human approval level.
Three rules keep it safe:
An agent never approves its own request. Same segregation of duties as for people.
Every agent limit has a gate above it. Anything over the limit stops for a named person.
Limits move on evidence. Raise a limit only after months of low override rates in the monthly review.
This is where a matrix stops being a document and starts being a control. The table says what's allowed; the process makes sure it happens. Our human-in-the-loop workflow guide covers how the gate above each limit should work.
How Vevos turns the matrix into a process
In Vevos, each row of the approval matrix becomes a gateway and an approval gate on an approved playbook, and the AI agent column becomes an authority limit.
Describe the approval process or upload your matrix, and Vevos drafts a BPMN 2.0 map with the thresholds as gateways and the approvers as lanes, plus documentation.
Mark the approval gates and set each agent's authority limit to match the AI column.
The process owner signs off on that version; version history and diff show exactly which threshold changed later.
Outside AI agents call the approved playbook through Unison over MCP, so they follow the same limits, and the stop switch halts any agent that misbehaves.
If you want a request and approval app, Conductor Agents build and deploy one from the reviewed map, starting on the Tempo plan.
What it doesn't do: Vevos doesn't replace your accounting or purchasing system. It holds the approval process and its rules. See pricing for plans.
FAQ
Short answers to the most common approval matrix questions.
What's the difference between an approval matrix and a RACI chart?
A RACI chart assigns who is responsible, accountable, consulted and informed for each task. An approval matrix sets who must approve each request at each amount. Use the RACI to name owners and the matrix to set their limits.
How do I make an approval matrix in Excel?
Make one row per request type and threshold band, with columns for threshold, approver, backup, deadline and agent limit. Use dropdowns for roles, an IFS formula to route by amount, protect the sheet, and keep a change log tab.
What are typical approval thresholds?
There's no standard. Many small companies start with a manager limit around $500 to $1,000 and a second level a few times higher, then adjust with their own request data. Treat any published numbers, including ours, as a starting point.
What is a delegation of authority matrix?
It's the company-wide document, often approved by the board, that says which roles can commit the company to spending, contracts and other obligations. Day-to-day approval matrices must stay within it.
Should an AI agent ever approve anything?
Yes, within a written authority limit on low-risk, easy-to-reverse requests, like small refunds or matched invoices, and always below the lowest human approval level. Anything above the limit should stop at an approval gate for a named person.
Related reading
These guides cover the rest of the control picture.
Put your matrix to work
The quickest way to start is to map the approval process behind the busiest row in your matrix.
Describe it at vevos.ai/free to get a BPMN map and documentation draft. When you're ready to add gates and agent limits, see plans and pricing.
Related blog posts
- AI Automation Playbook: How to Map, Document, and Automate Your First Processes — A practical AI automation playbook for operations teams: eight steps from listing processes to measuring ROI, a scored sample shortlist, a 30/60/90-day rollout, a worked vendor setup example and the mistakes to avoid.
- Human-in-the-Loop Workflow: Where to Put Approval Gates for AI Agents — A practical guide to human-in-the-loop workflows: five real examples, where to put approval gates and where not to, how a gate pauses and resumes an agent, how to draw it in BPMN, and how to measure whether it works.
- AI Agent Governance Framework: How to Govern AI Agents With Approved Processes — A practical framework for governing AI agents at work: six parts, the main agent risks, a technical controls layer, a copyable agent register, a crosswalk to IMDA, NIST and ISO/IEC 42001, and the metrics that show it works.