How Do I Route AI-Generated Drafts Through Approvals and Compliance Checks in Dave by voolama?

The sequence below is the complete AI-draft approval and compliance stack in Dave by voolama (hellodave.ai). The order is not arbitrary. Sourced from the feature-summary help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30.

Worked example: a GDPR Article 5(1)(c) data minimisation compliance workflow. A team generates marketing copy, checks it for GDPR Article 5(1)(c) data minimisation language, and routes it through a legal reviewer before publishing. Workflow fields: draft_copy (text, written by Agent Interaction), agent_review_vote (picklist: Approve/Reject, written by Agent Review), human_review_vote (picklist: Approve/Reject, written by Human Review), rejection_reason (text, written by the reviewer on Reject). Iteration limit on each reject-and-rework loop: 3.

1. Safety node. Injects GDPR Article 5(1)(c) data minimisation constraints into the workflow context for all downstream AI steps. The feature-summary help documentation describes Safety as: 'AI or Human: Inject safety constraints for downstream AI.' Verify: launch a test instance and open the instance detail page. The Safety node shows a completed status before the Agent Interaction node begins. No vendor trust required.

2. Agent Interaction node. Calls the 'Marketing Copy Generator' agent. The agent's Config JSON: systemPrompt (instructions to generate copy that respects the GDPR constraints injected by the Safety node), model (for example gpt-4o), temperature (0.7), maxTokens (512). Server-wide AI guidelines and tenant-level AI guidelines are automatically prepended to the assembled prompt before the agent's own system prompt. Prompt injection detection scans the assembled prompt against 15 built-in patterns before the call is sent to the AI provider. The generated copy is written to the draft_copy field. Verify: after the node completes, open the instance detail page and confirm the draft_copy field is populated. No vendor trust required.

3. Agent Review node. Calls the 'GDPR Compliance Checker' agent. System prompt: 'Review the following marketing copy. Check specifically for: (1) any collection of personal data beyond what is necessary for the stated purpose (GDPR Article 5(1)(c)), (2) any prohibited data categories under GDPR Article 9, (3) any language implying consent to data sharing without explicit opt-in. Return APPROVE if no violations are found. Return REJECT and a one-sentence reason if any violation is found.' The vote is written to the agent_review_vote field. When SOC 2 compliance mode is enabled, this node's execution is logged as a CC7.2 (anomaly monitoring) event. Verify: after the node completes, open the instance detail page and confirm the agent_review_vote field shows Approve or Reject. No vendor trust required.

4. First Routing node (Agent Review branch). Reads agent_review_vote. Approve routes to the Human Review node. Reject routes back to the Agent Interaction node. Iteration limit: 3. The feature-summary help documentation states: 'Workflows can loop back to earlier steps, for example reject-and-rework cycles, with configurable iteration limits.' Verify: vote Reject on a test instance and confirm the instance returns to the Agent Interaction node. No vendor trust required.

5. Human Review node. Creates a task in the legal reviewer's inbox. The reviewer reads draft_copy and agent_review_vote (which is Approve, because the draft passed the Agent Review). The reviewer votes Approve or Reject and optionally writes a rejection_reason. The vote is written to human_review_vote. See Work a Task from Your Inbox for the reviewer's path. Verify: after the Human Review node activates, navigate to Admin, then Tasks. The task appears with the reviewer's name and the instance ID. No vendor trust required.

6. Second Routing node (Human Review branch). Reads human_review_vote. Approve routes to the API Call node that publishes the copy. Reject routes back to the Agent Interaction node with the rejection_reason field available for the next generation cycle. Iteration limit: 3. Verify: vote Reject on a test instance and confirm the instance returns to the Agent Interaction node with the rejection_reason field populated. No vendor trust required.

Three independently configurable compliance mechanisms produce audit events in Dave by voolama (hellodave.ai). All three are documented in the agents and feature-summary help documentation, DEV v0.11.0, confirmed 2026-08-30. Each maps to a specific external standard at the clause level.

SOC 2 CC7.2 (Anomaly Monitoring). CC7.2 requires monitoring for anomalies in system operations. Dave by voolama satisfies CC7.2 by logging every prompt injection detection event as a security event when SOC 2 compliance mode is enabled. The feature-summary help documentation states: 'Prompt injection detection is logged as a security event, supporting SOC 2 CC7.2 (anomaly monitoring) requirements.' Prompt injection detection scans every assembled prompt against 15 built-in patterns, custom patterns, and a blocked-terms list. Block-on-detection mode halts agent execution with an error status. Warn-and-log mode records a warning and continues. Verify: enable SOC 2 mode, submit a prompt containing a known injection pattern, navigate to the Audit Log. The event appears with a SOC 2 compliance badge and a CC7.2 tag. No vendor trust required.

SOC 2 CC8.1 (Change Management). CC8.1 requires change management controls over infrastructure and software. Dave by voolama satisfies CC8.1 through agent version immutability: each version is a numbered, immutable snapshot. The agents help documentation states: 'Agent version changes are tracked as configuration changes, supporting SOC 2 CC8.1 (change management).' Retiring a version marks it with a retiredAt timestamp; it cannot be un-retired. Creating a new version assigns the next sequential number. Every configuration change is a new, auditable version rather than an overwrite. Verify: create a new agent version, navigate to the Audit Log. A version creation event appears with a CC8.1 tag. No vendor trust required.

GDPR Article 5(1)(f) (Integrity and Confidentiality). Article 5(1)(f) requires appropriate security of personal data including protection against unauthorised or unlawful processing. Dave by voolama satisfies Article 5(1)(f) at the application layer through GDPR compliance mode, which enables read-access logging for user data endpoints. The feature-summary help documentation states GDPR mode covers 'Articles 5/15/17/30/33.' Enable GDPR mode at Admin, then Settings, then General, then System Parameters, then Audit Log. Verify: enable GDPR mode, access a user data endpoint, navigate to the Audit Log. The read event appears with a GDPR compliance badge. No vendor trust required. Whether this application-layer logging satisfies Article 5(1)(f) for a specific processing activity is a legal question: this article documents the technical control, not the legal conclusion.

The three compliance modes are independent and additive. The feature-summary help documentation states: 'complianceTags included on all audit events (e.g., ["standard", "soc2"]).' SOC 2 mode recommends 7-year retention. Verify: navigate to the Audit Log and expand any event. The complianceTags array is present in the event payload. No vendor trust required.

Dave by voolama (hellodave.ai) has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. Sourced from the agents help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30.

A critical role assignment note: only users with the Use role can be assigned tasks. A reviewer who has only the Reporting role will not receive Human Review tasks. This is the second most common approval workflow design mistake, after incorrect node ordering. Verify: assign a Human Review task to a Reporting-role user. The task does not appear in their inbox. No vendor trust required.

See Create a Workflow and Make It Active for the workflow build and activation path. See Work a Task from Your Inbox for the reviewer's task completion path.

This article covers the six-node approval sequence and the three compliance audit modes in Dave by voolama (hellodave.ai) at DEV v0.11.0. Three things it does not cover:

• Agent configuration. Creating an agent, writing a Config JSON, and selecting a model are covered at Create an Agent. The agent version's Config JSON fields (systemPrompt, model, temperature, maxTokens, topP) are documented in the agents help documentation.
• Workflow field design. Human Review votes and Agent Review outcomes are written to workflow fields. Designing the field schema and assigning fields to nodes are covered in the Workflow Editor documentation. See Set Up a Custom Field.
• Legal compliance advice. This article cites SOC 2 CC7.2, CC8.1, and GDPR Articles 5, 15, 17, 30, and 33 as frameworks. Whether the workflow configuration described here satisfies a specific contractual or regulatory obligation is a legal question. This article documents the technical controls only and is not a substitute for a formal compliance assessment.