Approve the action that will happen.

Permission is more than a yes

Consider an illustrative rule: refunds above a threshold need approval. A reviewer authorizes a refund for a particular order, amount, currency and recipient. If any of those arguments changes, the original yes may no longer apply.

Bind an approval to the principal, logical intent, exact arguments, rule version and relevant state. Record who had authority to approve, when that authority expires and whether the approval is single-use.

Check again before the effect

An agent can propose an action, collect approval and later dispatch it. State can change between those steps. A qualified pre-effect binding checks current authority and arguments at the actual dispatch boundary.

Changing a policy, recipient or amount should cause re-evaluation. A UI that displays an approval is not itself a control. The integration must define how concurrent uses, expiry and revocation are enforced.

Give the reviewer a real decision

In the refund example, show the reviewer the exact recipient and amount, the reason for the request, any earlier attempts and what remains unknown. Make refusal and escalation usable. If the receipt is missing, a reassuring agent summary cannot establish that another refund is justified.

Test whether a reviewer can spot a changed recipient or an unresolved earlier attempt under realistic time pressure. Human approval is one part of the workflow; its effectiveness needs evidence. A record of which rule held an action explains the control decision. It does not establish why the model proposed the action or whether its judgment was sound.

Keep the negative cases

Test a changed amount, a changed recipient, an expired approval, a different principal and concurrent reuse. Preserve attempted action, decision and confirmed provider effect separately.

A held request is evidence of a decision. It does not by itself establish that no effect occurred through another writer or unsupported route. State the mediation boundary and remaining gaps.