Approval-mode drift

How approval-mode drift happens

Approval-mode drift is a runtime state change, not a policy document problem. The governing approval can be present in design docs, workflow diagrams, or admin intent, yet the live session may still become effectively unattended if the agent can continue executing after the approval boundary should have closed.

This usually appears when the session carries forward enough authority to keep calling tools, completing queued actions, or following stored context after the original human review point. The practical issue is that the decision boundary becomes weaker than the paperwork suggests, so the effective control is what the session can still do, not what the process says should happen.

Why this matters for agentic systems

In agentic environments, approval mode is part of the security posture because it determines whether a session is continuously supervised or can act with standing operational latitude. A drift from reviewed to unattended execution changes the trust model midstream, especially when the agent has access to APIs, data, or downstream tools that can amplify a single approval into many actions.

That makes approval state a control surface in its own right. If the runtime can silently persist authority, the system may look governed while behaving like an unsupervised automation path, which increases the chance of unintended actions, hidden escalation, and loss of operator intent.

What changes in the session state

Approval-mode drift is about state transitions: the agent begins in a constrained mode, then later inherits a looser effective mode through session persistence, queued tasks, retries, background workers, or a reused token-bearing context. The key question is whether the approval condition still applies at the moment a tool call is made, not merely at the moment the session started.

That distinction matters because runtime execution can diverge from the original authorization decision. If the agent can keep using previously granted access after the human review point has passed, the control becomes temporal rather than continuous, and temporal controls are easier to outlive than policy owners expect.

How to interpret approval boundaries

Approval boundaries should be treated as enforceable runtime states, not as advisory workflow labels. A sound model keeps the approved action scope, session lifetime, and tool access aligned so that unattended continuation is impossible unless it has been explicitly re-authorized.

For a useful conceptual anchor on identity-bearing material in agent flows, compare this with Salesloft OAuth token breach, where token handling and downstream access showed how a seemingly controlled integration can become a broad access path when runtime trust shifts.

Risk and Threat Considerations

Approval-mode drift creates exposure because a session that should remain reviewed can become effectively persistent and autonomous without a fresh decision point. That can lead to unauthorized tool use, broader data reach, or actions that no longer match the human reviewer’s intent.

Failure mechanism: Session state, token reuse, background execution, or cached authority outlives the approval boundary and allows the agent to keep acting after supervision should have ended.

Impact: The organisation can lose control over who approved what, when execution became unattended, and whether subsequent actions were still authorized, which increases the chance of data exposure, unexpected side effects, and hard-to-audit automation abuse.

Practitioner Guidance

Why practitioners should care: Approval mode needs to be observable at runtime, not inferred from workflow design. If operators cannot tell when a session has crossed from reviewed to unattended execution, the control is too weak to rely on.

Common misunderstanding: Teams often assume that an initial approval covers the whole session. In practice, the safe assumption is the opposite, the approval should expire with the decision it covered unless the session is explicitly renewed or re-authorized.

Practitioner takeaway: Treat approval state as an enforceable control property of the running session, and verify that the agent cannot silently continue on stale authority.

Related resources from NHI Mgmt Group

• Who should be accountable for approval and drift notifications in cloud infrastructure workflows?
• How should security teams automate SaaS access reviews to reduce approval drift and reviewer fatigue?
• Behaviour-to-Approval Drift
• Approval Drift