Old approval is becoming a state-management problem.
As agents move from chat into browser work, text-native approvals, and generated outputs, products need a way to decide whether prior consent still fits the current situation.
The new trust layer is expiry-aware
Personal agents are increasingly asked to take action after a human has stepped away. That makes consent expiry a core product primitive. A yes from five minutes ago may be valid if the cart, recipient, page, and amount are unchanged. The same yes may be invalid if the page content changed, the target account changed, or the generated output is now different.
This is particularly important for a text-message AI assistant, where the approval surface is intentionally compact. The compact reply needs a larger expiry-aware context record behind it.
Time
Some approvals decay because the opportunity, session, or price window is short-lived.
State
Some approvals decay because browser state, file diffs, or extracted evidence changed.
Scope
Some approvals decay because the agent has moved outside the originally approved boundary.
Market signals
- Agents are resuming tasks across sessions.
- Operators are approving from SMS and iMessage surfaces.
- Browser automation is preserving screenshots and page state.
- Generated pages and public outputs need rollback context.
- Risk frameworks keep pushing toward inspectable records.
Product implication
Approval systems that cannot expire consent precisely will either interrupt users too often or reuse permission too broadly. The better path is narrow consent that can age out when facts change.