A bank uses generative AI to draft commercial loan decisions, but regulators require a licensed officer to review and explicitly approve any adverse action before notification. Reviews must time out safely, retain audit trails, and prevent autonomous sending. Which human oversight workflow provides approval mechanisms for AI operations with AWS Step Functions?

The correct workflow is right because a Step Functions task using the callback pattern (.waitForTaskToken) pauses the execution until the officer's approve or deny decision arrives from the portal through SendTaskSuccess or SendTaskFailure, a task timeout with a Catch on States.Timeout routes unanswered reviews to a safe path that never sends the notice, and execution history plus CloudTrail provide the audit trail, so nothing is sent without explicit approval. Auto-emailing from Lambda fails on control because the adverse notice goes out with no officer approval at all, which is exactly what the regulator prohibits. Publishing drafts to SNS while the workflow continues fails because notification is only informational and the process does not wait, so the notice can be sent before or without review. Having officers poll DynamoDB and manually invoke Lambda fails on timeouts and auditability because nothing enforces a deadline, ties approval to the specific execution, or records the decision as part of the workflow, and it depends on people remembering to resume. Exam caveat is to distinguish a callback task token, which blocks on external human input with timeout handling, from Wait or Choice states or notifications alone. Practical check is to inspect the state definition for TimeoutSeconds and Catch on States.Timeout, verify portal identity and CloudTrail events, and test approve, deny, and expire paths to confirm no send occurs early.