We build and run Praxis, a content orchestration platform that sits over WordPress and adds AI drafting to a real editorial operation. This article is the part of that build most teams get wrong: the approval layer. Everything here is running in production; nothing is speculative.
The premise is blunt. A language model’s draft is a draft, not a decision. The moment machine output can reach your published site without a person saying yes, you no longer have an editorial operation, you have a liability with a CMS attached. The interesting engineering is in making the human yes cheap, fast, and impossible to skip.
Pattern one: provenance is a first-class field
Every content item in Praxis carries its origin: authored in WordPress, created on the platform, or drafted by a model and not yet reviewed by anyone. That last state is explicit and visible everywhere the item appears. The failure mode this prevents is subtle and common: AI drafts that look finished get treated as finished. Two weeks into any AI rollout, nobody remembers which paragraphs a person actually read.
The implementation decision that matters: provenance is set by the system at creation time and is not editable. If users can relabel an AI draft as human-authored, they will, with good intentions, on a deadline.
Pattern two: approval is the publish action
We do not have a review step and a publish step. Approving is publishing; there is no second lever to pull, and no path to the live site that routes around the review. Rejection requires a written reason, which sounds bureaucratic and is actually the cheapest training signal you will ever collect: three months of rejection reasons tell you exactly what your prompts and your model choice are getting wrong.
An AI draft opens its own review automatically. Nobody has to remember to request one, because a safeguard that depends on remembering is not a safeguard. The review queue is sorted so that machine drafts awaiting a first human read surface above everything else: they are the highest-uncertainty items in the system.
Pattern three: the ledger
Every review decision is recorded: who, when, approved or sent back, and what they wrote. This is not surveillance, it is institutional memory. When a published piece turns out to be wrong, the question “how did this get through” has an answer in seconds, and the answer is about process, not blame. Teams that skip the ledger end up reconstructing it from chat logs, badly, during an incident.
Pattern four: meter the drafting
Every generation is costed, in integer micro-cents to avoid floating-point drift in financial arithmetic, against a per-organization daily budget, with the prompt version recorded alongside the spend. Two reasons. The obvious one is that unmetered API spend is a surprise invoice waiting to happen. The less obvious one is editorial: when drafting has a visible cost, people write better briefs, and better briefs produce drafts that survive review. The meter is a quality tool wearing an accounting costume.
The failure modes we designed against
- Approval fatigue. If reviewers approve everything, the gate is theater. The rejection-reason requirement and the queue ordering keep the decision honest; the ledger makes rubber-stamping visible in aggregate.
- The side door. Every integration that can create content must route through the same review states. The first bypass anyone builds “just for migrations” becomes the permanent hole in the fence.
- Silent model changes. Prompts are versioned and the version travels with each draft. When output quality shifts, you can tell whether the model, the prompt, or the briefs changed.
- Trust by interface. A clean UI makes machine text feel edited. Provenance labels fight the instinct to trust typography over process.
What we would tell a team starting today
Build the approval layer before you build the drafting layer. It feels backwards, because the drafting is the demo and the approval is the chore. But drafting bolted onto an approval system inherits its discipline, while approval bolted onto a drafting system inherits its shortcuts. We have watched both orders play out; only one of them survives contact with a deadline.
And keep WordPress. The instinct to replatform because AI arrived is usually wrong: your editors’ muscle memory, your content history, and your workflows live there. Praxis treats WordPress as the authoring surface and holds the canonical model, the review states, and the meters itself. The machine drafts. A person approves. The system remembers. That order is the whole design.