AI agents are increasingly able to deploy code, modify infrastructure, query sensitive systems, and initiate financial operations. A conversational “Are you sure?” prompt is useful, but it is not independent authorization. The same agent that proposed the action may also control the confirmation flow.

I wanted an approval mechanism with four properties:

A person approves one specific action.

The approval expires quickly.

It cannot be replayed for another tool call.