Choose what Bob may do on its own, what needs approval and what must always go to a person. Every action is recorded with its reasons and sources.
Whatever your autonomy settings, these cases go straight to a person with the full context attached.