A marketing approval workflow with a cryptographic paper trail
Last updated 2026-07-16.
In most marketing tools, approval workflows are an optional feature bolted onto an auto-publish default. Pappus inverts that: the approval IS the publish gate. AI drafts your content, compliance checks run automatically, and a cryptographically signed human approval is the only thing that can make a post go live.
The approval is the gate
Enforced in the publisher, not the UI: publish calls verify the signed approval and refuse on mismatch. No off switch.
HMAC-signed approval events
Every approval is cryptographically signed and recorded in an append-only audit log — provable who, what, and when.
Role-based review
Owner, admin, editor, reviewer, and viewer roles. Reviewers approve content without access to billing or credentials.
Cascade approvals
Approve a coordinated multi-channel launch with one decision; each node publishes on its own staggered schedule.
Compliance before review
Channel policy linting and claim substantiation run before a human sees the draft, so review time goes to judgment, not proofreading.
Provenance on every asset
C2PA content credentials on every AI-generated image and video, signed with a real certificate.
Why approval workflows fail in most tools
The typical pattern is a checkbox: turn on "require approval" and the tool inserts a review step in front of its scheduler. The problem is that the enforcement lives in the UI, not the publish path — integrations, API calls, and "quick fixes" can route around it, and when something ships that shouldn't have, there's no reliable record of who approved what.
Pappus enforces the gate where it can't be bypassed: in the publisher itself. Every publish call re-reads the draft's state, verifies the HMAC signature on the approval record, and refuses to publish on any mismatch. Concurrent publish attempts are row-locked so a race can't double-post. There is no configuration that turns this off.
How the workflow runs day to day
Drafts arrive in a kanban-style queue — ready for review, blocked (with the reason on the card), approved and scheduled, published. Reviewers can approve, edit inline, refine with a comment, or block with a note; every action feeds the brand-voice memory. Role-based seats (owner, admin, editor, reviewer, viewer) let a reviewer approve content without touching billing or integration credentials.
Before a human ever sees a draft, the pipeline has already run a channel-aware policy linter, extracted and checked every claim against your approved-claims library (unsupported claims are hedged or annotated [citation needed]), and put the draft through an AI reviewer with a bounded auto-fix loop. For coordinated launches, cascade approvals let one decision cover a LinkedIn → blog → newsletter → email sequence with staggered publish times per node.
Evidence when someone asks
Every approval event is HMAC-SHA256 signed and recorded in an append-only audit log — who approved, what exactly (the signature covers the content), and when. Every AI-generated image and video carries a C2PA content credential anyone can verify. GDPR Article 17 deletion is honored within 30 days. If you operate somewhere this matters — finance, health, public sector — see the regulated-industries use case or the founding story behind the gate on the blog.
Frequently asked questions
What is a marketing approval workflow?
A marketing approval workflow is the process that routes content through human review before it publishes. In Pappus it's structural: AI drafts content, automated compliance checks run, and a cryptographically signed human approval is required by the publisher itself before anything can go live.
Can we require approval on every post?
It's the only mode. Pappus has no auto-publish setting to misconfigure — every post, image, email, and landing page waits for an explicit human approval.
Who can approve content?
Anyone with the owner, admin, editor, or reviewer role. The reviewer role is deliberately narrow: it can approve drafts without touching billing, integrations, or workspace settings.
What proof exists after something publishes?
An append-only audit log with an HMAC-signed approval event per publish (who, what, when), plus a C2PA provenance manifest on every AI-generated image and video. Both are verifiable — the publisher refuses to publish on a signature mismatch.
Does an approval gate slow the team down?
Less than you'd think: drafts arrive pre-checked in one queue you can review from a phone, blocked drafts show the reason on the card, and cascade approvals cover a whole launch with one decision. Most operators batch approvals into one short session.
Want to see this work on your brief?
Contact us