Yes. An approval is a person's judgement on specific facts at a specific moment. If the action runs later, or the facts change, it no longer covers them. Approvals should expire on a time limit and on any change to what was approved, with the check made at the moment the agent acts, not when the person clicked approve.
What exactly should expire?
Three different things get called approvals, and each needs its own rule.
A pending request. The agent has held an action and is waiting for a person. If nobody decides within the window, the request should not sit forever; it should escalate to named cover, then lapse and return to the queue with fresh facts.
A granted approval not yet used. A person approved a payment on Friday; it executes on Tuesday. If the payee's bank details changed on Monday, Friday's approval did not cover Tuesday's payment.
A standing approval. A category of action pre-approved for a period, such as refunds under a set amount for one product during a recall. These are exceptions to the agent's usual bounds, and they need an end date; see why every exception to an agent's bounds should expire.
When should each one expire?
| Kind of approval | Expires when | On expiry |
|---|---|---|
| Pending request | The decision window passes | Escalates to named cover, then returns to the queue |
| Granted, not yet executed | Time limit passes, or amount, payee, account or customer status changes | Action is refused; agent re-drafts and holds again |
| Standing approval | Its end date, or the condition behind it ends | Category reverts to normal bounds |
| Approval tied to a person's authority | The person's authority changes | Unused approvals are re-held for another approver |
The second row is the one most often missed. An approval should be bound to the exact facts the person saw. If any of them change, the approval is void, however fresh it is.
Who decides the windows, and where is it enforced?
The process owner proposes the windows, because they know how fast facts move in their process. Risk agrees them, because a long window is a loosening of control. The windows are written into the customer's own limits for that process, not left to each reviewer.
Enforcement has to happen at the moment of action. Checking validity when the approval is granted proves nothing about when it is used. So when the agent goes to execute, the approval is checked again: is it within its time limit, do the facts still match, does the approver still hold the authority? If not, the action is refused and the verdict says why.
What does this look like in practice?
Take a mid-sized manufacturer's finance team. The agent drafts a payment of 18,000 to a supplier and holds it. A finance manager approves it late on Thursday for the Friday payment run. Friday's run fails for an unrelated reason and is rescheduled for Monday.
Over the weekend, an email arrives claiming to be from the supplier with new bank details, and someone updates the record. On Monday the agent checks the approval before release. The payee account no longer matches what was approved. The action is refused, the verdict names the changed account as the reason, and the payment is re-held with the change highlighted. The finance manager sees the new account, sends it for verification, and the fraud attempt is caught.
Without expiry, Thursday's approval would have released Monday's payment to the new account.
Which controls make expiry work?
- Approvals are bound to facts. Each records the amount, payee, account and any other material field it covered.
- Re-check at execution. The approval is validated when used, not only when granted.
- Named cover for pending requests. Expiry triggers escalation, not silence.
- Short default windows. Long windows need a reason and risk's agreement.
- Expiry is recorded. A lapsed approval is a filed event, so you can see where decisions are too slow.
Expiry also helps with rubber-stamping. When approvals lapse, reviewers cannot clear a backlog in one sweep days later; they decide while the facts are current. More on that in how to avoid rubber-stamping AI agent approvals.
The same reasoning applies to standing authority: an AI agent's permissions should expire too. Expiry is one of the basic habits in our guide to agent governance.
Questions people ask
How long should an approval last?
Long enough for the normal gap between approval and execution in that process, and no longer. For payment runs that is often until the next scheduled run; for customer communications it may be hours.
Does expiry create more work for approvers?
A little, on the items that lapse. That work is the point: each lapse is either a fact change worth seeing or a sign that approvals are too slow.
Should an expired approval be renewable with one click?
No. Renewal is a new approval of the current facts, so the person should see what changed, if anything, before deciding again.