If a reviewer's certificate lapses on Friday, their right to approve held actions should pause on Friday too. Approval rights over AI agents' work exist because someone showed they could judge it. When that evidence expires, the right should expire with it, automatically, until the person renews. Anything else runs a control on stale evidence.
Why should a right follow the evidence?
Look at how a governed agent earns its own authority. It is certified on the business's own cases, capability by capability. Its certificate lapses after 90 days. A run that clears no depth drops it to depth 1 the same day. Its authority is never granted once and assumed forever; it is renewed on fresh evidence or it falls away.
People who approve the agent's held actions are the control on what it hands back. It would be strange to hold the agent to a lapsing standard and the approver to none. Yet that is what happens when approval rights are granted at onboarding and never revisited. A reviewer certified at launch keeps approving long after their certificate expires, the product changes, and their memory of the less common procedures fades.
The reasoning that an AI agent's permissions should expire applies to the people around it. Authority should last exactly as long as the evidence behind it.
Can a business actually do this?
Yes. It is a practice a business can adopt, and the mechanics are not complicated. Approval rights in the workspace are granted per capability and depth. A business decides which certificate each right requires, records the certificate's expiry, and sets the right to pause on that date. The question of whether approval rights can depend on a current certificate is answered by policy and configuration together, and the steps are in how to tie approval rights to certificates in an agent workspace.
What changes for the person is narrow. They keep their job and keep working the queue. They can still review, investigate and draft their own view. What pauses is their final approval on held items at the depth that needs certification. Those items route to a colleague with current standing until the person renews.
Should all approvals expire, or only some?
The rule should follow the risk. Approvals at depth 2, where the agent drafts and a person sends, may need only literacy. Approvals at depth 3 and 4, where the person is authorising routine execution or money movement, are where a lapsed approver matters most.
There is a related question about whether individual approvals, not just approval rights, should expire: a held item approved but not yet executed may need re-approval if circumstances change. That is covered in whether AI agent approvals should expire. The two ideas reinforce each other: authority is time-limited, and so is any single use of it.
For actions that are hard to undo, many businesses go further and require two certified people. A two-person approval procedure template shows how to combine that with certificate-based rights, so both approvers must be current.
What is the trade-off?
Automatic expiry causes disruption. A reviewer who forgot to renew loses approval rights overnight. If several lapse together, the held queue may outrun the certified reviewers left. Managers will be irritated, and reviewers will feel penalised for an administrative slip.
There is also the case of the competent person who is simply late. On the day after their certificate lapses, they are no less able than the day before. Pausing their rights can look like process winning over sense.
Both concerns are real and manageable. Disruption is mostly a planning problem: expiry dates are known months ahead, so reminders, renewal time and cover can all be arranged. A business that is surprised by lapses is not tracking them. As for the competent late renewer, the point of a rule is that it applies without case-by-case judgement. Make exceptions and you are back to rights that outlast the evidence. Keep renewal light, with an update module and a short check, and the pause rarely lasts long.
What happens if you do not tie rights to expiry?
The certificate becomes decoration. People earn it to get approval rights, and then the expiry date has no effect. Auditors sampling approvals will find held actions approved by people whose standing had lapsed months earlier, and the business will have no answer except that nobody checked. When something goes wrong, the record shows a name on the approval and a lapsed certificate behind it.
What should you do differently?
- Map each approval right to the certificate it requires, capability by capability and depth by depth.
- Record certificate expiry dates and check them at source.
- Configure rights to pause on expiry, with held items routing to certified colleagues.
- Send reminders well ahead and give people time to renew.
- Keep cover planned so a lapse never leaves a queue without a certified reviewer.
- Make no exceptions, and keep renewal light enough that exceptions are not needed.
The guide to AI agent skills by role shows which roles need which level.
Where the Academy fits
Pryme Intelligence Academy's certificates carry clear expiry dates: 12 months for Operator and Builder, 24 for Architect. Each can be checked at source, where a lapsed certificate shows as lapsed. For teams, an admin view shows certificates and expiry dates, which gives a business the information it needs to make approval rights depend on a current certificate, depth by depth.
Questions people ask
Is there a grace period after a certificate lapses?
That is a business decision. Many choose none for depth 4 approvals and a short one for lower depths, but any grace period should be written down and applied evenly.
What if the only certified reviewer on shift lapses?
Held items wait or route to a certified reviewer elsewhere. The situation should never arise if cover is planned against known expiry dates.
Does this apply to managers as well as reviewers?
Yes. Anyone who approves held actions at a depth that requires certification should be covered, whatever their seniority.