What happens when approval is granted but the agent changes the request before sending it?

The approved call should not be reusable if the agent changes the recipient, content, or other material details before send. A changed call must be refused because the approval only covers the exact request that was reviewed. Teams should verify this by checking the sent-mail record and the controlled inbox, not just the policy log or allowance decision.

Why the Approved Request Stops Being Reusable Once It Changes

An approval is only meaningful for the exact request that was reviewed. If the agent changes the recipient, content, attachment, routing, or other material fields before sending, the earlier approval no longer matches the action being taken. That is a classic approval drift problem: the policy decision is stale, and the send step must be treated as a new request.

In practice, this matters because the reviewer approved a specific message, not a broad permission for the agent to improvise after the fact. The safest operating assumption is that any post-approval edit invalidates the decision unless the system re-evaluates the request and records a fresh approval for the revised version.

This is especially important when an agent can compose or modify outbound communications on behalf of a person or workflow. The control objective is not just to approve intent, but to keep intent, content, and execution bound together so that the approved payload is the payload that actually leaves the system.

What Must Be Bound Together Before Send

To keep approval trustworthy, teams need a hard link between the reviewed request and the final transmitted action. That means the system should compare the approved version against the send-time version and block the send if anything material changed. The most important fields are the ones that alter business meaning or destination, not cosmetic formatting.

Good binding usually includes a stable request identifier, immutable approval record, and a send-time check that enforces exact match or policy-defined equivalence. If the agent can swap the recipient, add hidden recipients, change the body, or redirect the output to another channel without invalidating approval, then the approval process is only advisory.

The operational question is whether the approval covers the final side effect, not merely the draft. For agentic workflows, that distinction is critical because the agent may be able to recompose the request after approval, sometimes in ways the reviewer never sees.

How Teams Should Prove the Control Is Working

The right verification target is the transmitted record, not only the policy decision. Teams should confirm that the sent-mail record, outbound API event, or delivery log matches the approved request and that the controlled inbox or destination reflects the same content and recipient set. If the final artifact diverges, the control failed even if the policy engine showed approval.

A useful test is to approve one version, alter a material field, and verify that the send is refused or forced back into review. If the system still delivers the changed version, the approval boundary is too weak and the workflow needs a stronger compare-and-block step.

This is also where audit evidence matters. Reviewers should be able to reconstruct what was approved, what was sent, and which system state caused the final decision. If those three views cannot be reconciled, the approval chain is not reliable enough for high-impact actions.

Risk and Threat Considerations

When approval can be separated from the final action, an agent can turn a legitimate decision into an unauthorized one by changing the payload after review. That creates exposure to misdelivery, data leakage, fraud, and policy bypass, especially when the recipient or content change is subtle enough to evade human notice.

Failure mechanism: The approval applies to an earlier draft, while the agent sends a different final message, so the control no longer governs the actual side effect.

Impact: Sensitive information can be sent to the wrong party, business instructions can be altered, and the approval process becomes a false assurance instead of a real safeguard.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Agentic AI Top 10	ASI03 — Identity & Privilege Abuse	Covers post-approval agent privilege misuse and unauthorized action changes.
	ASI02 — Tool Misuse	Applies when an agent alters a request before using the send tool or channel.
Recommendation — Enforce per-action authorization so changed agent requests cannot reuse an earlier approval. Validate the final tool input against the approved request before execution.
NIST SP 800-53 Rev 5	AU-6 — Audit Record Review, Analysis, and Reporting	Sent-vs-approved reconciliation depends on auditable records of the final action.
	AC-6 — Least Privilege	Limits an agent's ability to modify or redirect approved outbound actions.
	IA-5 — Authenticator Management	Covers lifecycle control for tokens or credentials used by sending agents.
Recommendation — Compare approval records to outbound events and investigate any mismatch. Restrict agent permissions so approval cannot be stretched into broader send authority. Rotate or revoke any credential that can send modified requests without reauthorization.

Practitioner Guidance

What to verify: Require a send-time equality check between the reviewed request and the final outbound payload, and treat any difference in recipient, body, attachment, or route as a blocking condition unless a new approval is captured.

Decision rule: If the agent can still edit the request after approval, do not rely on the approval log as evidence of control; rely on the transmitted artifact and the system that enforced the final compare.

What good looks like: The approved draft, the final send event, and the delivered message all match, and the system can prove that any material mutation forces a re-approval instead of silent execution.

Practitioner takeaway: Approval is only a guardrail when it is bound to the exact outbound payload, because any post-approval mutation converts a reviewed decision into an unreviewed action.