Approval Is Not a Boolean: What Must Still Be True When an Agent Resumes?

Human approval is a decision about one action under a particular set of facts. It is not a permanent permission bit. Imagine an AI agent preparing a refund request: Order: SO-1001 Amount: CNY 199.00 Reason: Duplicate payment The runtime classifies the action as high risk, pauses the task, and asks a human to approve the exact request. At 10:00, the approver reviews the parameters and clicks Approve . The task does not execute immediately. It remains paused, waits in a queue, survives a coordinator restart, and finally reaches dispatch at 15:00. During those five hours, any of the following may have changed: the order may already have been refunded by another channel; the refund policy may now require an additional finance review; the approver may no longer hold the required role; the acting subject may have left the organization; the amount or currency may have drifted during task reconstruction; the tool implementation may have changed; the approval may have been valid for only 30 minutes. Should the system execute merely because a database row still says approved = true ? No. The approval was not a timeless grant. It was a decision about a specific action, represented by a specific subject, using a specific capability, with specific arguments, under a specific policy and set of business facts. This distinction becomes essential when agents move beyond answering questions and begin creating real business consequences. 1. The dangerous simplification: approval = true In conventional administrative software, approval and execution are often close together. A user submits a form, a manager approves it, and the system performs the action soon afterward. That interaction encourages a simplified mental model: approval = true Once that value is stored, downstream code treats the action as permanently authorized. Agent tasks are different. A single task may cross several asynchronous boundaries: understand intent -> select a capability -> construct arguments -> request app