How Can a Small Marketing Agency Use AI Without Losing Control of Client Work?

In Dave by voolama (hellodave.ai), each client lives in a separate workspace (tenant) on its own subdomain, with its own users, roles, workflows, instances, tasks, and data. The separation is enforced using PostgreSQL row-level security (RLS) policies, documented at postgresql.org/docs/current/ddl-rowsecurity.html. RLS is an open standard: any PostgreSQL administrator can read and verify the specification independently of the vendor.

The PostgreSQL RLS documentation states: 'When row security is enabled on a table, all normal access to the table for selecting rows or modifying rows must pass a row security policy.' Dave by voolama applies this at the database layer: a query that fails to identify its workspace returns no rows, and a write that attempts to place a record in another workspace is refused by the database engine before the application layer is reached. The application cannot override it: the database connection Dave by voolama uses to serve requests holds no privilege to bypass those policies.

In Dave by voolama (hellodave.ai), the Human Review task is the mechanism that ensures no AI draft reaches a client without a named person deciding on it first. The workflow pauses at the Human Review node, creates a task in the Task Inbox, and waits for a decision before continuing.

Three things the reviewer can do on every Human Review task in Dave by voolama:

1. Read the Payload. The Payload section shows the JSON data passed from the workflow to the task. Review it carefully before deciding.
2. Add a Comment. An optional free-text note. Even a brief note explaining why you rejected or requested changes helps workflow owners understand the history. For an agency, the comment is the reviewer's professional judgment on record.
3. Click a decision button. Approve (green), Reject (red), or Request Changes (outlined). The decision is recorded immediately in the audit log with the reviewer's user ID and a timestamp. EU AI Act Article 14(4) (Regulation EU 2024/1689, eur-lex.europa.eu) requires that AI systems allow human oversight to intervene or interrupt output. The Human Review task aligns with Article 14(4) by requiring an explicit human decision before the workflow continues.

Only the Admin and Use roles can view the Task Inbox and submit decisions. Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. A team member who only reviews drafts needs the Use role. See Work a Task from Your Inbox for a step-by-step walkthrough.

Every Human Review task decision in Dave by voolama (hellodave.ai) is recorded in the audit log with the acting user, the decision, the optional comment, and the timestamp. When SOC 2 or GDPR compliance mode is active, these events are tagged with SOC 2 CC6.1 (logical access) and GDPR Article 30 (records of processing activities).

For a small marketing agency, the audit trail serves two distinct purposes:

1. Internal accountability. The audit log shows which team member approved each AI draft, when, and with what comment. Navigate to Admin, then Settings, then Audit Log to view and export the full record. Only the Admin role can access the Audit Log.
2. FTC endorsement compliance for AI-assisted content. When an agency uses AI to draft content that includes client endorsements or testimonials, 16 CFR Part 255.5 (FTC Guides Concerning the Use of Endorsements and Testimonials, ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255) requires disclosure of material connections between an endorser and the brand. The Human Review audit record, which captures the reviewer's name, decision, and timestamp, is the agency's evidence that a named person reviewed and approved the content before it was used. This does not substitute for the disclosure itself: 16 CFR Part 255.5 requires the disclosure to appear in the content. The audit record is evidence of the review process, not a replacement for the required disclosure. Whether a specific workflow configuration satisfies 16 CFR Part 255.5 in a given situation requires a qualified professional's assessment.

A hypothetical agency workflow for a client social campaign: User Interaction (account manager submits the campaign brief), Agent Interaction (AI drafts three caption options), Human Review (senior copywriter reviews and approves one option with a comment noting the approved choice), End. The audit log records: the account manager's submission, the AI agent invocation, the copywriter's Approve decision with comment, and the workflow completion. The full record is exportable as CSV from Admin, then Settings, then Audit Log.

This article covers client workspace isolation, the Human Review task, and the audit trail in Dave by voolama (hellodave.ai). Three things it does not cover:

• Building the workflow graph step by step. Connecting nodes, configuring edges for Reject and Request Changes paths, and setting the workflow to active are covered in the companion guide: How Do I Set Up My First AI Workflow for My Small Business?
• Connecting an AI provider. Adding an OpenAI, Anthropic, or other provider to a workspace is covered in the Add an AI Provider quick-reference.
• Legal compliance advice. This article cites EU AI Act Article 14(4), 16 CFR Part 255.5, and NIST SP 800-53 Rev 5 AC-6 section 6a as technical mapping references, verifiable at the URLs provided. The compliance standard mappings are technical observations about how the product's design aligns with published standards: they are not an independent audit. Whether any specific workflow configuration satisfies a particular legal or regulatory obligation requires a qualified professional's assessment. This article is not legal advice.