In build Case studyDesign levelHuman approval gate

Self-Serve Campaign Automation With a Human Approval Gate

A non-technical sender fills in a short form and picks a brand-locked template. The system assembles the campaign, renders it, and routes it to a named approver. Nothing schedules until a person signs off, and there is no field in the form that can break the brand.

In builddescribed at design level0unreviewed sends, structurallyLockedbrand lives in the template1 pathout. No side door

Built by Patrick Joseph Panuncillon, AI Director and Applied AI Systems Architect. Designed, built, shipped, and operated by one builder with AI augmentation.

The problem

Both obvious fixes make it worse.

  • Campaigns bottleneck on whoever knows the email platform. Requests queue behind one person, and time-sensitive campaigns go out late or quietly do not go out at all.
  • Give more people direct access and brand consistency degrades immediately. Typography, layout, disclaimers, and sending identity drift campaign by campaign, and no single instance looks bad enough to trigger a fix.
  • So the real constraint is uncomfortable: the answer cannot be more access, and it cannot be one gatekeeper. It has to be a path where the fast way and the correct way are the same way.

The solution

Make the form the guardrail.

A short form is the entire interface. The sender chooses a brand-locked template and supplies only the content that legitimately varies: audience, subject, and body copy. Everything structural is fixed inside the template and is not exposed as a field.

The system assembles the campaign deterministically, renders a real preview, and routes it to a named approver. Approval is a required step in the path, not a notification that can be missed. Only an approved campaign is scheduled, and it is scheduled through a single code path with no bypass.

The design principleIf a field cannot be wrong, it cannot be got wrong. Brand governance implemented as training is a hope. Implemented as an absent form field, it is a guarantee.

How it works

Six steps, one of which is a person.

FormAsk only for what varies

The sender provides audience, subject, and body content. Nothing else is requested, because nothing else should be theirs to decide.

TemplateBrand-locked by construction

Layout, typography, footer, legal disclaimers, and sending identity live in the template. No form field overrides them, so no submission can produce an off-brand campaign.

AssembleDeterministic build

The campaign is assembled the same way every time from the template and the submitted fields. Same input, same campaign, which is what makes a preview meaningful.

PreviewWhat is approved is what sends

The approver reviews the rendered campaign itself, not a summary or a description of it. There is no gap between the artefact reviewed and the artefact sent.

GateA named human approves

Approval is a required transition, not an alert someone might action. Without it the campaign does not reach the scheduler at all.

ScheduleOne path out

An approved campaign is scheduled through a single code path. There is no secondary route, manual override, or admin shortcut that skips the gate.

01Sender fills formAudience, subject, body. Nothing structural
02Brand-locked templateLayout and identity not editable
03Deterministic assemblySame input, same campaign every time
04Rendered previewThe real artefact, not a description
05Named approverRequired transition. No bypass exists
06Scheduled sendOne code path out
The gate is a structural step in the path, not a policy layered on top of it.

Status and scope

In build. Described honestly as such.

Where this system actually is

This system is in build. The form, the template lock, deterministic assembly, and approval routing are implemented. It is described here at the design level only. Production results will be added to this page when it has run long enough to have them, and not before.

Why it is included anyway

The interesting content is the design decision, not the outcome. Choosing to remove fields rather than add training is a repeatable pattern, and it is the part that transfers to another business.

What is deliberately absent

No language model sits in this path. Campaign assembly is templating and validation. Adding a model here would introduce variance into the one place the business needs none.

What it demonstrates

The skills behind the system.

Self-serve internal toolingBrand governance implemented in softwareDeterministic templatingApproval workflows and structural gatingMarketing-platform integrationInterface design for non-technical usersPreventing error by removing the fieldKnowing where not to use a modelWorkflow automation

Outcome and what is next

In build. The bottleneck stops being a person.

When it ships, the campaign bottleneck stops being an individual and brand consistency stops depending on discipline, because the only available way to send is the correct one. Results will be published here once it has been running long enough to report them honestly.

Confidentiality and intellectual property

This is an anonymized portfolio write-up. It names no client or employer and discloses no source code, prompts, credentials, endpoints, schemas, customer data, or exact commercial terms. Third-party vendors in the client's operational stack are described by category rather than by name. Figures are rounded or banded.

Intellectual property in every system described here belongs to the organization that commissioned it. Nothing on this page is a claim of ownership, a transfer of rights, or an offer to license, sell, or reproduce any system. This page records authorship and build credit only, and it is published in a personal capacity, not on behalf of any employer or client. See Authorship and verification for the full disclosure standard.

If any part of this page is inaccurate, or a rights holder considers it to exceed that standard, contact consultwithpatrick@gmail.com and it will be corrected or removed promptly.