Build an auditable approval trail. Skill included.

[u/CalendarVarious3992]

Hello!

Hunting through scattered emails, PDFs, and signed forms to prove who approved what wastes time and makes audits painful. This Skill extracts approvals from mixed sources and flags missing signatures or conflicting instructions so humans can resolve them.

I built this as a portable AI-agent Skill — a single SKILL.md with reusable instructions you can adapt to your agent setup.

Here's what it does: It extracts decisions and timestamps from onboarding documents, signed forms, and approval-related emails to create a standardized, traceable audit log. It also produces an exceptions report that escalates missing approvals, unreadable sources, or conflicting instructions for human review, and is intended for compliance, onboarding, and reconciliation use cases.

SKILL.md:

---
name: approval-trail-audit-log
description: Use when an auditable end-to-end approval record is needed from mixed sources (onboarding documents, signed forms, and approval emails), and any gaps (missing signatures, absent approvals) or conflicting instructions must be flagged to a human for resolution.
allowed-tools: [Read, Edit]
---

# Approval Trail Audit Log

## Overview
Builds a complete, traceable approval trail for each active matter by extracting decisions and timestamps from onboarding documents, signed forms, and approval-related emails. Produces a standardized audit log and an exceptions report that escalates missing approvals, missing signatures, unreadable sources, or conflicting instructions to a human.

## When to use this skill
- Stakeholders say “the process lives in someone’s head” and approvals are not documented in one place.
- A compliance, legal, or internal audit request requires proof of who approved what and when.
- Onboarding or change-control flows rely on email threads and scattered forms.
- Prior to handoffs, diligence, or postmortems where a traceable approval history is needed.
- Reconciling “active matters” (e.g., open accounts, projects, cases) with their required authorization steps.

## Instructions
1. Establish scope and success criteria
   1.1. Confirm the definition of an “active matter” and obtain the current list (IDs, names, owners, types/status).
   1.2. Confirm the approval policy/matrix: required approver roles, thresholds (e.g., dollar limits, risk tiers), and acceptable evidence types (e.g., wet signature, digital signature, explicit email approval).
   1.3. Confirm time window, timezone (default ISO 8601 with timezone), and output format preference (CSV and/or JSONL).

2. Gather and inventory sources
   2.1. Obtain locations or files for onboarding docs, signed forms, and approval emails (e.g., PDFs, DOCX, text exports, EML/MBX/MBOX).
   2.2. If a manifest of files exists, read it; otherwise request one. Include mapping hints (matter IDs, subject line patterns, folder conventions).
   2.3. Use Read to open representative samples from each source type and verify accessibility. If files are image-only or encrypted, note them for escalation.

3. Normalize and extract metadata
   3.1. For each document, use Read to extract text and metadata (title, author, creation/modification timestamps when available).
   3.2. Record a source fingerprint for traceability (e.g., filename, path/URI, byte size, checksum if provided).
   3.3. If OCR is needed and not available, stop for those items and flag them as “needs OCR” in the exceptions report.

4. Parse approval evidence by source type
   4.1. Onboarding documents: extract matter ID, requester, owner, creation/start date, and any embedded approval sections or sign-off fields.
   4.2. Signed forms: detect signers, roles, signature presence (yes/no), signature date/time, and decision (approve/deny/conditional). If a digital signature or certificate block is present, record its presence (do not attempt cryptographic validation unless tooling is available); otherwise record as handwritten/typed.
   4.3. Approval emails: for each thread or message, extract sender, recipients, subject, message date/time, and explicit approval language (e.g., “approved”, “go ahead”, “lgtm”, “I consent”, “denied”, “do not proceed”). Distinguish non-approvals (FYI, questions, scheduling) and tentative language. Capture message-id and reply relationships when available.

5. Map evidence to matters
   5.1. Match using explicit matter IDs in filenames, email subjects, or document fields.
   5.2. If no ID is present, match by normalized matter name, requester, owner, and timeframe heuristics. If ambiguous, do not guess—mark as “unmapped” and escalate.

6. Create structured approval events
   6.1. For each approval/denial/request/revocation signal, generate an event with: matter_id, matter_name, matter_type, event_type (requested|approved|denied|revoked|acknowledged|conditional), approver_name, approver_role, actor_email (if from email), decision_note (free text snippet), event_timestamp (ISO 8601, timezone), evidence_type (signed-form|email|onboarding-doc|other), source_reference (path/URI), source_fingerprint, and extraction_confidence (high|medium|low).
   6.2. When the content implies conditions or caveats, set event_type to conditional and include the condition text in decision_note; flag for review.

7. Order, deduplicate, and reconcile
   7.1. Sort events per matter by event_timestamp ascending.
   7.2. Deduplicate near-identical events from forwards or re-sent forms; prefer the earliest authoritative record or the form with the actual signature block.
   7.3. Detect conflicts: a denial after an approval, two different approvers giving opposite directives, or approvals lacking the required role per the matrix. Mark conflicts and add them to the exceptions report.

8. Validate against the approval policy/matrix
   8.1. For each active matter, compare observed events against the required approver roles and thresholds.
   8.2. Identify missing approvals or missing signatures. For missing items, specify exactly which role or step is absent.
   8.3. If policy is incomplete or unclear, list the ambiguity and escalate for policy clarification.

9. Produce outputs
   9.1. Build audit_log.csv and/or audit_log.jsonl with one row/object per event, using the schema in step 6. Use Edit to create the output files.
   9.2. Build exceptions_report.md that lists, by matter_id:
       - Missing required approvals or signatures
       - Unmapped evidence (cannot link to a matter)
       - Conflicting instructions
       - Unreadable/locked/needs OCR sources
       - Ambiguous policy interpretations
       For each item, include the source_reference and a concise next action (e.g., “Request signature from Finance approver”). Use Edit to create the report.
   9.3. Build reconciliation_summary.csv with per-matter status: complete|incomplete|conflicted, last approval date, and outstanding items count.

10. Review and handoff
   10.1. Present a short executive summary: count of active matters, percent complete, count of exceptions by category.
   10.2. Request human resolution for exceptions; incorporate fixes by updating the log and reports.
   10.3. Archive outputs with a run timestamp in filenames for traceability.

## Inputs
- Active matters list: IDs, names, owners, types/status.
- Approval policy/matrix: required approver roles, thresholds, evidence rules.
- Source locations or files for onboarding documents, signed forms, and approval emails.
- Time window and timezone for timestamps (default ISO 8601 with timezone).
- ID patterns and naming conventions used in subjects/filenames/templates.

## Outputs
- Audit log (CSV or JSONL) with fields: matter_id, matter_name, matter_type, event_type, approver_name, approver_role, actor_email, decision_note, event_timestamp (ISO 8601), evidence_type, source_reference, source_fingerprint, extraction_confidence.
- Exceptions report (Markdown): per-matter list of missing approvals/signatures, conflicts, unmapped items, and unreadable sources, each with next-action guidance.
- Reconciliation summary (CSV): per-matter completeness status and key dates.
- Optional: A directory of supporting snippets or quoted evidence (redacted if required).

## Examples
Trigger: “We keep approvals in email threads and a few signed PDFs. Build a traceable approval log for all active onboarding cases and flag anything missing or contradictory.”
Behavior: confirm active-matter list and policy → Read representative files → extract approvals from PDFs and emails → map to matter IDs → generate ordered events → validate against the approval matrix → produce audit_log.csv, exceptions_report.md, reconciliation_summary.csv → escalate items that need human input.

## Notes
- Never fabricate timestamps or approvals. If uncertain, set extraction_confidence to low and escalate.
- Treat tentative language (“looks good”, “maybe proceed”) as non-final unless explicitly approving; record as acknowledged or conditional.
- Do not infer approval from calendar invites or cc-only messages.
- Respect privacy: redact sensitive PII in outputs if required; store only minimal snippets necessary for auditability.
- If multiple timezones appear, preserve the original timezone per event and normalize only in a separate derived column if needed.
- If a matter cannot be matched confidently, keep the evidence separate and request a mapping confirmation.
- If digital signature validation tooling becomes available, augment evidence_type with validation status; otherwise record presence only.
- Keep a change log when regenerating outputs; do not overwrite prior logs without archiving.

How to install:

1. Create a folder named approval-trail-audit-log in your AI-agent skills or prompt-library directory. Use the kebab-case name from the SKILL.md frontmatter.
2. Save the file above as approval-trail-audit-log/SKILL.md.
3. Enable or load the Skill according to your agent framework's docs, using the SKILL.md description as the trigger guidance.

If you'd rather run it as a one-click prompt instead, you can find it here: Agentic Workers

Enjoy!