An agent's permission to act rests on evidence from one moment: a model version, a set of sources, a process, a mix of cases. All of those change. Permissions that never expire outlive the evidence that justified them. Expiry forces a simple choice at regular intervals: show fresh evidence that the agent still earns the authority, or let it drop.
Why does an agent's authority go stale?
A person's competence tends to grow with experience. An agent's fitness for a task can erode without anyone touching it. Four things drift underneath a standing permission.
The model changes. Providers release new versions and retire old ones. Behaviour shifts, sometimes in ways that matter for your cases and sometimes not. The agent certified on one version is now running on another.
The sources change. Product terms, fee schedules, policy documents and procedures are updated. An agent that was accurate against the old versions may misapply the new ones, or keep relying on a copy that is no longer current.
The process changes. A new approval step, a reorganised team, a different system of record. The agent's permissions were set for the old flow.
The work changes. New products, new customer segments, a seasonal rush of unusual cases. The mix the agent was tested on no longer matches the mix it receives.
None of these announces itself. A permission granted against one set of conditions keeps working, silently, after the conditions are gone.
What does expiry achieve that monitoring alone does not?
Monitoring watches for problems. Expiry asks for proof of fitness. They are different questions, and you need both.
Monitoring catches drift that shows up in outcomes: rising refusals, more edits by reviewers, complaints. It is reactive by design, and it only sees what it was built to look for. Some drift does not show up until a rare case arrives, by which time the damage is done.
Expiry is proactive. It does not wait for a signal. At a set interval, the agent must be re-tested on current cases from the business's own operation, and its permission renewed only if it clears. If nobody renews it, the permission lapses and the agent loses that authority. The burden of proof sits with whoever wants the agent to keep acting.
How long should an agent's permissions last?
Long enough for the evidence to mean something, short enough that conditions cannot drift far. Ninety days is a reasonable default for capabilities that let an agent execute work or move money: it is long enough for meaningful operational evidence and short enough to catch model, source and process changes within a quarter. In Pryme, certificates issued by Attest lapse after 90 days on that basis.
| Depth of the capability | Suggested expiry | Reason |
|---|---|---|
| Read | Review with access cycle | Low harm, but access should still be checked |
| Draft, a person sends | Renew on evidence periodically | Errors reach a reviewer first |
| Execute routine work within bounds | 90 days | Errors reach customers or records directly |
| Move money or take hard-to-undo actions | 90 days, or sooner on any change | Errors are costly and may be irreversible |
Expiry should also be event-driven. A significant model change, a major source update or a process redesign should trigger re-testing before the scheduled date. If a re-test fails, the agent should lose the authority that day, not at the end of the period.
What evidence should renewal require?
The same kind of evidence that granted the permission in the first place, drawn from recent work. That means replaying the agent against a current sample of the business's own cases and scoring each answer against the standard the capability requires: grounded in its sources, refusing when it should, staying within scope, escalating what it cannot handle.
Renewal should not be a formality. If the agent clears comfortably, renew. If it clears narrowly, renew with closer monitoring or a lower limit. If it fails, drop the capability to a depth the evidence still supports and investigate. Our guide on how to set permissions for an AI agent covers how the original grant should be structured so renewal has something clear to test against.
How does this relate to approvals and exceptions?
Permissions, approvals and exceptions are three layers, and each should expire on its own clock. A permission is the agent's standing authority for a capability. An approval is a person's sign-off on a decision, such as allowing an agent into production or widening its depth. An exception is a temporary variation to a bound.
All three go stale for the same reasons. Our piece on whether AI agent approvals should expire argues the case for approvals, and every exception to an agent's bounds should expire makes it for variations. The rule that ties them together: no exception or approval should outlive the permission it sits on.
What happens to the work when a permission lapses?
It goes back to people, or to a lower depth. If an agent's authority to execute refunds lapses, refunds it would have issued are now held for a named person or drafted for someone to send. That creates load, and the load should be planned for.
This is where expiry creates useful pressure. If a lapse would cause a backlog nobody can absorb, the owner has a strong reason to renew on time, which means producing the evidence on time. If a lapse causes no noticeable change, the permission may not have been needed.
What is the trade-off?
Expiry costs effort. Every renewal needs fresh cases, a test run, someone to review the results and a decision. For an organisation with many agents and many capabilities, that becomes a standing workload. There is also a risk of disruption if a renewal is missed and a capability lapses on a busy day.
Both costs are manageable with scheduling and automation. The cost of standing permissions is harder to manage, because it is invisible until the day an agent, certified on conditions that no longer exist, does something nobody would have approved today. List every permission your agents hold and the date of the evidence behind each. Anything older than a quarter, for a capability that executes or moves money, should be re-tested now. The full governance structure is in our guide to agent governance as a bound, not a model.
Questions people ask
Does expiry mean the agent stops working on the expiry date?
Only the lapsed capability is affected, and only at the depth the lapsed evidence supported. The agent can keep working at a lower depth, such as drafting for a person to send, until fresh evidence restores its authority.
Can renewal be automatic if nothing has changed?
Renewal can be scheduled and run automatically, but it should still be based on a fresh test against recent cases. "Nothing has changed" is an assumption expiry is designed to check.
Should read-only permissions expire too?
They should be reviewed regularly, usually as part of the access review cycle, because read access to sensitive data carries its own risk. The evidence needed is lighter, since a read cannot change a record, but the access should still be justified.