Content governance and approval workflows: decide who decides, before you need to

Approval workflows have a reputation for slowing teams down. Usually that’s because they were designed as one blanket rule: everything goes to the same senior person, who checks typos, facts and strategy in one pass. Good governance does the opposite. It decides in advance which work needs a person at all, and makes the decisions that remain fast and specific.

Why “one approver for everything” fails

A single sign-off step creates three problems at once:

• Bottlenecks. Low-risk fixes queue behind high-risk launches.
• Shallow review. An approver checking forty items skims, so the risky claim gets the same three seconds as the typo.
• No accountability. When something goes wrong, it’s unclear what was actually approved: the draft, the final, or the channel it went to.

The fix isn’t more approvers. It’s sorting work by consequence.

The authority matrix

Set permissions along four dimensions. We call this the authority matrix:

Dimension	Question	Example values
Action	What is being done?	Research brief, page refresh, new page, social post, press pitch
Destination	Where does it go?	Internal only, owned site, brand social account, employee’s account, media
Risk	What could go wrong?	Factual error, legal exposure, reputational harm, consent breach
Owner	Who answers for it?	Web lead, social lead, comms lead, the named person

A rule is then one line that combines them: “Corrections to existing owned pages, where every changed claim has a company source, may proceed; the web lead is notified.”

Three outcomes, decided before the work starts

Every rule resolves to one of three outcomes. Writing them down is the single most useful governance step most teams skip.

1. Proceed within scope. The work meets the agreed evidence, cost and destination rules, so it goes ahead and the owner is notified.
2. Bring it for approval. The work is finished and checked, and a named person decides before it goes further.
3. Stop and explain. Evidence is missing, a limit is reached or the action falls outside the rules. The work halts, and the reason is recorded.

“Stop and explain” matters more than it looks. A workflow that can’t stop will eventually publish something it shouldn’t, because the only alternative is to sit in a queue forever.

A starter rulebook you can adapt

Action	Destination	Outcome	Who
Internal research brief	Internal	Proceed	None
Fix outdated claim with a company source	Owned site	Proceed	Web lead notified
New page or major rewrite	Owned site	Approve	Web or content lead
Brand social post	Company account	Approve	Social lead
Post in a person’s name	Their account	Approve	That person, personally
Press pitch or outreach	Media	Approve, or stop if outside this workflow	Comms lead
Claim about a competitor	Any public channel	Stop unless a current, citable source exists	Logged for review

Start strict. Loosen a rule only when a particular workflow has a track record of clean work, and write down why you loosened it.

Make every approval specific

An approval should be tied to exactly what was reviewed:

• the version (a material edit after approval sends the work back);
• the destination (approving a blog post doesn’t approve the press pitch built from it);
• the action (approving a draft isn’t approving publication);
• the expiry (time-sensitive claims need re-approval if publishing slips).

This sounds bureaucratic, but it speeds things up: approvers decide once, and nobody argues later about what was signed off.

Verify before you ask for approval

Most approval delays are really verification delays: the approver finds a missing source and sends the work back. Move checking ahead of approval with a short checklist:

• Every factual claim links to a source, ideally primary
• Quotes are verbatim and attributed, and the person agreed to them
• Statistics show their date and population
• No competitor claim without a current, citable source
• Images and media have cleared rights
• Brand rules (terms, tone, banned topics) are met
• Destination and publish time are stated

When the approver gets a package that has already passed this list, the decision is about substance: is this the right thing to say, here, now?

Keep a record people can follow

For audits, and for learning, keep one decision record per published piece:

• what started it (the opportunity);
• the evidence behind each claim;
• the drafts and checks;
• who approved what, for which destination and version;
• what was published, where and when.

If a regulator, client or journalist asks “why did you say this?”, the answer should take minutes, not a week of digging through email.

People, consent and personal accounts

Content attributed to a real person, whether an executive post, an expert quote or employee advocacy, needs extra rules:

• Only the named person can approve content in their name.
• Participation in advocacy programmes is voluntary, and saying yes once doesn’t mean yes forever.
• Never invent an anecdote, quote or opinion to make a draft more compelling.

These rules protect people and the brand at the same time. They also produce better content, because real experience reads differently from invented experience.

When automation joins the workflow

AI systems can now prepare and even publish content, and the outside world is paying attention. Gartner notes that “government regulations across the globe are already holding companies accountable as they begin to require the identification of marketing content assets that AI creates.” Google warns that using generative AI to “generate many pages without adding value for users may violate Google’s spam policy on scaled content abuse.”

That raises the stakes on governance: an automated workflow with one global “autopilot” switch is a single point of failure. The authority matrix carries over directly. An automated system should check every action against the same rules a person would, proceed only where the rules allow, and stop and explain everywhere else. More on this in our agentic marketing playbook.

Rolling it out in two weeks

1. Days 1–3: List every action your team takes and every destination it publishes to.
2. Days 4–6: For each pair, agree the outcome (proceed, approve or stop) and the owner.
3. Days 7–9: Add the verification checklist ahead of approval.
4. Days 10–14: Run every piece of work through the new rules, keep decision records, then adjust the rules that caused friction.