WF-20260612-027 · v1
Control Plan · PROJECT surface
Control Plan
Supervised
Customer win-back email batch
CONFIDENCE · MEDIUM
HANDOFF · BUILD_READY
PROJECT SURFACE
CHECKPOINT REQ.
RULE-09
HUMAN APPROVES
AI drafts a batch of personalized win-back emails to lapsed customers and stages them for review. A named marketing manager evaluates the batch and approves before anything sends. The verdict is SUPERVISED under RULE-09: the terminal action is outbound external customer communication at scale — reversible only at reputational cost — so it requires human authorization before execution.
What AI prepares
ProducesA review packet: per-recipient draft (subject + body + offer code) plus a batch summary sheet
Placed at/review/winback/ in the marketing workspace — never the send queue
Namingwinback_batch_YYYY-MM-DD_vN.zip
⛔ Approval Checkpoint
EXECUTION BLOCKS HERE UNTIL A HUMAN SAYS YES
Reviewer
Marketing Manager · lifecycle
named role — not "someone on the team"
Reviews
Offer accuracy, segment eligibility, tone, suppression-list compliance, and unsubscribe footer on every draft
Approves when
All drafts pass review · ≤ 0 suppression-list hits · offer codes match the approved campaign sheet
Rejects when
Any suppression hit, wrong offer, or off-tone draft → entire batch returns to /review, not sent
Turnaround
Within 4 business hours of staging
· batch holds until decision is recorded
Post-approval actions
- 01Release batch to ESP · executor: AI · system: email platform API
- 02Confirm send receipts · executor: AI · system: ESP webhook
- 03File approval + receipts · executor: Marketing Manager · system: campaign log
Prohibited without approval
▪May not send, schedule, or queue any email before approval is recorded
▪May not alter the recipient list or offer after staging
▪May not under any condition bypass the suppression list
approval/ winback_2026-06-12.log · outputHash · reviewer=ID · approvedAt · decision=APPROVED|REJECTED · rejectReason · retain 7y
Expected outcomes
APPROVED_AND_EXECUTEDReviewer confirmed eligibility; refund issued, approval record retained
REJECTED_BY_REVIEWERReviewer denied the request; reason logged, customer notified through standard channel
ANALYSIS_DELIVEREDEligibility analysis produced, approval checkpoint active, awaiting reviewer decision
BLOCKEDRequired order or delivery evidence is missing; analysis halted, request held in queue
FAILEDDuplicate request detected or idempotency check failed; no refund issued, incident logged
Autonomy expires when
Workflow steps, inputs, or outputs change materially
AI surface or tool changes
Policy or compliance context changes
✓An incident occurs · always applicable
Error rate exceeds threshold
Recertification interval passes
✓Reviewer role changes or becomes vacant — always applicable for SUPERVISED. If the named reviewer leaves, the Control Plan must be updated before execution resumes.
Build Handoff Pack
BUILD_READY
Human checkpoints ★Blocking approval by the lifecycle Marketing Manager; send is technically impossible until an APPROVED record exists for the batch
Terminal-action boundaryRelease the approved batch to the ESP; no list edits, no re-sends, no second batch without a new approval
Deterministic controlsSend call is gated on the presence of a signed approval token for the exact batch hash
Acceptance testAttempt a send with no approval token → blocked & logged; attempt with a valid token → releases
Current state
DISPOSITION_PENDING
Who acts next
Operations owner
Exact next action
Confirm the named reviewer, prove the block in acceptance test, record disposition for v1
Operator Disposition
The Gate may recommend — the operator signs
APPROVE_FOR_BUILD
HOLD_FOR_EVIDENCE
REVISE
REJECT
Gate recommendationAPPROVE_FOR_BUILD — once the named reviewer is confirmed and the block is proven