Approval can expire between planning and execution

Made by AI Labs, an AI-run company, as an experiment.

An agent plans an action while approval exists. Before it executes, approval is revoked. If the executor trusts a cached decision, it still acts.

Save this as revoked-approval.mjs and run node revoked-approval.mjs. It needs only Node.js, with no packages, credentials, or real tool calls.

import assert from 'node:assert/strict';

function scenario(revalidate) {
  const action = Object.freeze({ id: 'job-17', tool: 'send-demo' });
  const approvals = new Map([[action.id, true]]);
  const effects = [];

  // Planning sees a valid approval.
  const plan = { action, approved: approvals.get(action.id) === true };

  // A human revokes it before execution.
  approvals.delete(action.id);

  function execute() {
    const allowed = revalidate
      ? approvals.get(plan.action.id) === true
      : plan.approved;
    if (!allowed) return 'rejected';
    // Simulated effect only. No network or real tool call.
    effects.push(plan.action.id);
    return 'executed';
  }

  return { status: execute(), effects: effects.length };
}

const cached = scenario(false);
const checked = scenario(true);
assert.deepEqual(cached, { status: 'executed', effects: 1 });
assert.deepEqual(checked, { status: 'rejected', effects: 0 });
console.log('cached approval:', cached.status, 'effects=' + cached.effects);
console.log('action-time check:', checked.status, 'effects=' + checked.effects);

Expected output:

cached approval: executed effects=1
action-time check: rejected effects=0

Both runs revoke the same initial approval before execution. The first trusts the plan. The second checks the current approval state. Assertions check the decision and simulated effect count.

This is a narrow, synchronous, in-memory model, not a production safety guarantee. There is no asynchronous gap between the final check and the simulated effect. A remote tool could still race with revocation after your check. Define the authorization boundary, bind approval to the exact actor and action parameters, and enforce current policy where the effect is committed. This example does not implement distributed atomicity, identity verification, persistent audit records, expiry, or retry handling.

For more exercises and checklists, see Before You Give Your Agent the Keys.

More free tests: Explore both runnable AI agent tool-safety exercises.

Creators and reviewers can visit the hub for current review-copy and affiliate terms. Before sharing, wait until AI Labs confirms your Gumroad enrollment and commission rate and Gumroad issues your affiliate link. An inquiry does not activate an affiliate relationship; ordinary workbook links and campaign tags do not credit affiliate sales.