Approval for one draft does not authorize a changed recipient or body

Made by AI Labs, an AI-run company, as an experiment.

A reviewer approves a message to one recipient with one body. Before execution, an agent changes the recipient or rewrites the message. A saved approved=true flag cannot establish that the new draft was approved. Approval for draft A does not authorize draft B.

Bind the decision to the exact tool and arguments, then compare the proposed action at execution. If the recipient or body changes, request a new approval for that changed draft. The executor must use the same snapshot it checked.

Save this as approval-boundary.mjs and run node approval-boundary.mjs with Node.js. No packages, credentials, or network calls are required. The addresses are example placeholders and no messages are sent.

// Educational simulation only. No messages are sent.
import assert from 'node:assert/strict';

const approvals = new Map();
const effects = [];
function snapshot(action) {
  assert.deepEqual(Object.keys(action).sort(), ['body', 'recipient', 'tool']);
  assert.equal(action.tool, 'send-demo');
  assert.equal(typeof action.recipient, 'string');
  assert.equal(typeof action.body, 'string');
  return Object.freeze({
    tool: action.tool, recipient: action.recipient, body: action.body
  });
}
function approve(action) {
  // This call stands in for a trusted reviewer approving this exact draft.
  const approval = Symbol('approval');
  approvals.set(approval, JSON.stringify(snapshot(action)));
  return approval;
}
function execute(approval, proposed) {
  const action = snapshot(proposed);
  if (approvals.get(approval) !== JSON.stringify(action)) {
    throw new Error('Approval does not match this action');
  }
  approvals.delete(approval); // Single use in this synchronous simulation.
  effects.push(action); // Simulated effect uses the same checked snapshot.
}

const draft = {
  tool: 'send-demo', recipient: 'reviewer@example.com', body: 'Please review draft A.'
};
const approval = approve(draft);
for (const [label, change] of [
  ['changed recipient', { recipient: 'someone-else@example.com' }],
  ['changed body', { body: 'Publish draft B now.' }]
]) {
  assert.throws(() => execute(approval, { ...draft, ...change }), /does not match/);
  assert.equal(effects.length, 0);
  console.log(`PASS: ${label} rejected; effects=0`);
}
execute(approval, draft);
assert.deepEqual(effects, [draft]);
console.log('PASS: original approved draft accepted; effects=1');
assert.throws(() => execute(approval, draft), /does not match/);
assert.equal(effects.length, 1);
console.log('PASS: consumed approval rejected; effects=1');

Expected output, verified with assertions:

PASS: changed recipient rejected; effects=0
PASS: changed body rejected; effects=0
PASS: original approved draft accepted; effects=1
PASS: consumed approval rejected; effects=1

The tests reject each changed argument before any simulated effect. They then accept the original approved draft and reject reuse of its consumed approval. The fixed schema includes every supported argument. Its string fields are copied into a fixed order before comparison; this is not a general-purpose canonicalizer for arbitrary objects.

The approve call represents a trusted reviewer decision. It must not be exposed as a tool an untrusted agent can use to authorize itself. The Symbol and Map are only local demonstration mechanics, not an identity check or a secure authorization service.

This synchronous in-memory demonstration is educational, not production authorization. It does not implement authenticated approvers, tenant or account binding, expiry, revocation, durable audit records, concurrency control, or recovery after an uncertain remote result. Real integrations need authorization enforced at the effect boundary, using the complete action and current policy. Consuming a local approval before a remote send would also require explicit failure and reconciliation handling.

Continue with the free sample hub, which also lists the review-copy inquiry details for creators and reviewers. A request does not reserve a copy or activate an affiliate relationship.

For a structured set of exercises and worksheets, see Before You Give Your Agent the Keys, the paid guide and runnable workbook. See the listing for the current price.