Durable Approval Tokens Are Unsafe Unless Bound to Exact Approved Parameters

A software engineering discussion highlights a critical flaw in human-in-the-loop AI agent approval systems: persisting an approval token does not guarantee it reflects what the human actually reviewed. Between the moment a user approves an action and the moment it executes, underlying details such as file contents, symlinks, or recipient lists can silently change. This mirrors the classic time-of-check to time-of-use (TOCTOU) race condition, but stretched across minutes or hours due to human response time and process restarts. The proposed fix is to bind each approval to a cryptographic fingerprint of the exact parameters rendered to the user, then recompute and verify that fingerprint at execution time, failing closed on any mismatch. Aggressive expiry of approval tokens is also recommended, as it limits how stale a decision can become before it is acted upon.