AWS launched Smart Approvals in Amazon Quick on October 28; a November 4 post explains its operation.
The big change
- Existing denials and mandatory human approvals still apply.
- Single-use approval covers one action and its exact parameters; failures or timeouts return to the user.
- A classifier can make mistakes; mandatory review should be configured in policy.
How the decision works
According to the Quick guide, automated review applies when the connector lets the user choose and the user selects “Ask each time.” An action set to always ask still requires a person; an always-allow action follows that setting directly. Smart Approvals is on by default, but deny-by-default profiles require explicit permission. Users can turn it off across conversations and scheduled runs. It is available in desktop and mobile apps, not the web version.
A separate classifier considers the request and conversation, potentially approving low-risk, request-consistent actions to reduce routine prompts; consequential or uncertain actions return to the user. In AWS’s example, a retrieved note adds a large mailing list to two requested recipients. The changed send is designed to return for review, not guaranteed to do so.
The broader issue is indirect prompt injection: NIST defines prompt injection as an attack involving untrusted input and a higher-trust prompt. A document can be useful task material while also containing instructions that should not become the user’s authorization. The example illustrates that risk, not measured detection.
What the logs establish
AWS says an approval-related CloudTrail event does not prove execution. Investigators can compare it with conversation logs and destination-system records, where available, to reconstruct what happened.
