to authority because a chat becomes risky when it becomes an action. Capability is not execution. The model can request an action. Requestability is not authority. Approval needs a shape. In this approval drift issue, expired approved call back was stated as retraable. The state call back state durable served restarts and blocked later channel work. The battle click existed. The valid authority did not. This is the mistake. Treating approval as a vague memory that the human was near the system or clicked yes. Approval as a scoped execution state, it must stay bound to the action it authorized. An expiration must terminate rather than loop. A useful approval object answers who approved in what session and run for which tool and for which arguments and for how long and with what outcome. It also point to the receipt. If those fields fall off during a retry replay or a channel call back the harness can no longer prove the action was being executed is the action being approved. The general lesson is simple. Capability is not execution. Least privileges narrows the tool surface. Scoped credentials ensures the right identity is used for the action. Approval and audit decides what happens before and after the execution. The model can reason about the boundary but it should not be the boundary. The model can request but the still the