In today's rapidly evolving world of Artificial Intelligence, I wanted to go beyond experimenting with Large Language Models (LLMs) and explore how AI can be integrated into real-world business workflows. My goal was to understand how AI systems can process unstructured data, extract meaningful information, validate results, and support decision-making while maintaining reliability and human oversight.
As organizations continue to handle growing volumes of invoices, reports, contracts, and other business documents, manual processing can become time-consuming and difficult to manage efficiently. I wanted to explore how modern AI technologies could help simplify these processes by combining intelligent document processing, automated workflows, and context-aware information retrieval into a single application.
That motivation led me to build the AI-Powered Document Intelligence & Approval Platform.
The idea was to create more than a traditional document management system. I wanted to explore how Large Language Models, Retrieval-Augmented Generation (RAG), and agentic workflows could work together to classify documents, extract structured information, apply validation rules, and make document content accessible through an AI-powered assistant. At the same time, I wanted to ensure that important business decisions remained under human control through a human-in-the-loop approval workflow.
To bring these ideas together, I worked with technologies including Next.js, TypeScript, FastAPI, PostgreSQL, LangChain, LangGraph, ChromaDB, OpenAI, Model Context Protocol (MCP), AWS S3, and Docker. Each technology helped me explore a different aspect of building a complete AI-powered application, from frontend development and backend API design to document retrieval, workflow orchestration, persistent storage, and external tool integration.
Throughout the development process, I explored how to connect AI capabilities with conventional software engineering practices such as authentication, role-based access control, document lifecycle management, and audit logging. This helped me better understand that building a useful AI application involves more than integrating an LLM; it requires designing a complete system around data quality, security, workflow reliability, and accountability.
In this article, I'll walk through the motivation behind the project, its architecture, the document processing pipeline, the RAG-powered assistant, the human approval workflow, the technologies I used, and the key lessons I learned while building the platform.
Project Demo
Watch the demo to see the document processing workflow, AI-powered document assistant, and human-in-the-loop approval system in action.
Demo Video: https://drive.google.com/file/d/1QCYanANUBEmQn6LIpcwOEvcEy43g9GKv/view?usp=drive_link
Project Repositories
- Frontend: https://github.com/Madesh-cse/AI-Document-Approval-system-frontend
- Backend: https://github.com/Madesh-cse/AI-Document-Approval-system-backend
From Documents to Decisions: Building an AI-Powered Document Intelligence & Approval Platform
Turning unstructured documents into actionable insights with LLMs, agentic workflows, RAG, and human-in-the-loop approval.
Every organization works with documents— invoices, contracts, reports, and business records. But behind every document lies a time-consuming process: extracting information, validating it, routing it to the right person, and tracking decisions.
Traditional document management systems help store and organize files, but they don't always understand their contents or automate the decisions that follow.
I wanted to explore how AI could bridge this gap, so I built an AI-Powered Document Intelligence & Approval Platform that combines document processing, intelligent retrieval, workflow automation, and human oversight in one system.
In this article, I'll walk through the architecture, key technologies, workflow design, and engineering decisions behind the project.
What Does the Platform Do?
The platform transforms uploaded documents into structured, searchable, and reviewable information.
Instead of manually reading every document and transferring its details into a system, users can upload a document and let the application handle the initial processing.
The platform supports:
- Intelligent document processing: Classifies documents and extracts relevant information.
- Validation guardrails: Checks extracted data before it proceeds through the workflow.
- Human-in-the-loop approval: Allows managers to review, approve, or reject documents.
- Document-specific AI assistant: Answers questions using the contents of a selected document.
- Role-based access control: Separates permissions for administrators, managers, and employees.
- Workflow automation: Uses MCP-based Google Calendar integration to schedule approval reviews.
- Auditable document lifecycle: Tracks document status and approval activity.
The objective isn't to replace human decision-makers. It's to reduce repetitive work while keeping important decisions accountable.
Technology Stack
I selected the following technologies to build the application across the frontend, backend, AI, storage, and deployment layers.
| Technology | Purpose |
|---|---|
| Next.js, TypeScript | Frontend and application interface |
| Tailwind CSS | Responsive UI styling |
| Python, FastAPI | Backend APIs and application logic |
| PostgreSQL, SQLAlchemy | Relational data persistence and ORM |
| LangChain | LLM integration and retrieval components |
| LangGraph | Stateful, multi-step AI workflows |
| OpenAI | Language understanding, extraction, and question answering |
| ChromaDB | Vector storage for document retrieval |
| AWS S3 | Persistent document storage |
| MCP | Integration with external tools, including Google Calendar |
| Docker | Containerized application setup |
Each component has a specific responsibility, helping keep the system modular and easier to maintain.
## Introduction
1. Designing the Document Processing Pipeline
A document upload is only the beginning. The system needs to turn that file into information that can be validated, searched, and reviewed.
I designed the processing workflow around the following stages:
Upload → Classification → Information Extraction → Validation → Indexing → Human Review → Approval or Rejection
Step 1: Document upload
Users upload supported PDF, JPG, or PNG documents. The backend validates the file type and size before processing it.
The original document is stored in AWS S3, while the application's database maintains the associated metadata and workflow state.
Step 2: Classification and extraction
The AI processing layer identifies the document category and extracts relevant fields into a structured representation.
For example, an invoice may contain:
- Invoice number
- Vendor name
- Invoice date
- Total amount
- Payment-related details
Structured output makes it easier for downstream application logic to validate and use the information.
Step 3: Validation guardrails
LLM output should not automatically be treated as correct.
The validation layer checks whether the extracted information satisfies the application's requirements. Invalid or incomplete data can be flagged for additional review rather than silently passing through the workflow.
This distinction is important: an AI model can interpret information, but application rules must determine whether that information is acceptable.
Step 4: Human review
After processing, the document can enter a pending-review state.
Managers can inspect the extracted information and supporting document before approving or rejecting it. This creates a clear boundary between AI-assisted preparation and human authorization.
2. Why I Used LangGraph for Agentic Workflows
A document workflow is not always a simple sequence of LLM calls. Different outcomes may require different actions.
For example, a document with missing information should not follow exactly the same path as a document that has passed every validation check.
LangGraph helps represent this kind of process as a stateful graph, where nodes perform operations and edges determine what happens next.
In this project, the workflow separates responsibilities such as:
- Document processing
- Validation
- Content indexing
- Review scheduling
- Human approval
This makes the workflow easier to understand and extend than placing every operation inside one large function.
It also provides a foundation for conditional routing, error handling, and human-in-the-loop interruptions.
One important design principle guided this implementation: agentic workflows should have clearly defined responsibilities and controlled transitions, not unrestricted autonomy.
3. Building a Document-Specific RAG Assistant
Final Thoughts
One of the most useful features is the AI assistant that answers questions about an uploaded document.
A general-purpose language model may generate a plausible answer without knowing the contents of a particular invoice or contract. Retrieval-Augmented Generation (RAG) addresses this limitation by retrieving relevant document content before generating an answer.
Here's how the retrieval pipeline works:
- Extract text from the uploaded document.
- Split the text into manageable chunks.
- Generate embeddings for those chunks.
- Store the vectors and associated metadata in ChromaDB.
- Convert a user's question into a retrieval query.
- Retrieve relevant document chunks.
- Provide the retrieved context to the language model to generate an answer.
For example, a user might ask:
“What is the total amount on this invoice, and which vendor issued it?”
Rather than relying only on the model's general knowledge, the assistant retrieves relevant information from the selected document and uses it to formulate the response.
Why document-specific retrieval matters
The assistant is designed to answer questions within the context of the selected document. This helps reduce irrelevant retrieval and makes responses more useful for document analysis.
It is also important to recognize that RAG does not eliminate hallucinations. Retrieval quality, source relevance, prompt design, and output validation all influence answer reliability.
For a production-ready implementation, I would further strengthen the assistant with explicit source citations, retrieval confidence checks, and tests for unsupported answers.
4. Keeping Humans in the Loop
Automation is valuable, but business workflows often require accountability.
Consider an invoice with an unexpected total or incomplete vendor information. Automatically approving it because an AI model returned a confident answer would introduce unnecessary risk.
The platform therefore separates the processing result from the approval decision.
- The AI prepares and validates information.
- The application maintains the document's workflow status.
- The manager reviews the document.
- The manager makes the approval or rejection decision.
- The system records relevant lifecycle and audit information.
This design supports transparency and makes it easier to understand what happened to a document throughout its lifecycle.
Human review is not merely an additional screen in the application. It is an architectural control over how AI-generated information becomes an operational decision.
5. Connecting AI Workflows to External Tools with MCP
AI applications become more useful when they can interact with tools beyond the language model itself.
I integrated the Model Context Protocol (MCP) with Google Calendar to support scheduling approval reviews.
The workflow connects document processing with a real-world follow-up action: when a review needs to be scheduled, the application can use the calendar integration to create an event.
This demonstrates how an AI-enabled workflow can go beyond generating text and coordinate with an external service.
However, tool integration also introduces responsibilities around authorization, input validation, failure handling, and duplicate actions. These need to be handled carefully when expanding the integration.
6. Security, Storage, and Application Architecture
AI capabilities are only one part of a reliable document platform. The surrounding application needs to manage access, data, and workflow state correctly.
Authentication and role-based access control
I implemented secure authentication and role-based access control for administrators, managers, and employees.
Permissions determine which document operations are available to different roles. This is particularly important when documents contain business or financial information.
Database and file storage
PostgreSQL stores structured application data, with SQLAlchemy providing the ORM layer. AWS S3 handles persistent document storage.
Separating file storage from relational metadata makes the responsibilities of each component clearer.
Docker
Docker provides a consistent containerized setup, helping reduce differences between development and deployment environments.
These infrastructure decisions complement the AI workflow by giving the application a foundation for data persistence, access management, and maintainability.
7. Engineering Lessons and Trade-Offs
Building this project reinforced several important lessons about AI application development.
1. Structured output is not the same as validated output.
A model can return correctly formatted JSON while still producing incorrect values. Schema validation and business rules remain essential.
2. Retrieval quality matters as much as generation quality.
A strong language model cannot reliably answer a document-specific question if the relevant content was not retrieved. Chunking, embeddings, metadata, and retrieval strategy all influence the result.
3. Workflow state deserves explicit design.
Document statuses and approval transitions should be managed consistently. AI processing, database updates, and external tool calls should not be treated as one indivisible operation.
4. Automation should be proportional to risk.
Classification and information extraction are good candidates for automation. High-impact business approvals often benefit from human authorization.
5. Integrations create failure scenarios.
Storage operations, database transactions, model calls, and calendar events can fail independently. Retry policies, clear error states, and idempotent operations are important considerations as a system grows.
These lessons apply far beyond document processing. They are relevant to AI-powered support systems, compliance workflows, enterprise search, and other applications that combine probabilistic models with deterministic business logic.
What's Next?
There are several directions in which I would like to evolve the platform:
- Improve extraction evaluation with representative test documents and field-level accuracy metrics.
- Add stronger source citations and confidence-aware handling to document question answering.
- Expand workflow observability with structured logs, execution traces, and failure metrics.
- Introduce more comprehensive automated tests for permissions, approval transitions, and AI outputs.
- Add asynchronous processing for larger document workloads.
- Strengthen security with more granular authorization, retention policies, and audit controls.
The next stage is not simply adding more AI features. It is measuring reliability and making the existing workflow more robust.
Building this platform helped me explore how modern AI components can work together inside a practical software application.
LangChain and LangGraph provide building blocks for AI integration and stateful workflows. RAG connects language-model responses to document content. MCP enables interaction with external tools. Meanwhile, authentication, authorization, validation, storage, and audit logging provide the application-level controls needed around those capabilities.
The most important takeaway is that building a useful AI application requires more than connecting an LLM to an API. It requires designing the complete system around data quality, workflow state, security, and human accountability.
This project represents my continued exploration of AI engineering: moving beyond isolated model experiments and building applications that integrate AI into real software workflows.
I'd love to hear from other developers:
When building AI-powered business applications, where do you draw the line between autonomous processing and mandatory human approval?
Top comments (0)