How do I put expiry and timed re-approval on agent escalation thresholds?

What should I check, step by step?

1. List the escalation knobs that matter: risk tier, per-transaction / daily spend caps, tool or merchant allowlists, auto-approve-below-amount, permission mode, and any "always approve this tool" flags.

2. Never raise a knob forever from chat memory or AGENTS.md. Mint an approval that names the agent, the old value, the new value, a reason, issued_at, and expires_at (minutes to hours for high-risk raises; never "until we remember to turn it down").
3. Bind the yes to a hash of those fields (and the live policy_version). Store the grant in a server DB, checkpointer, or ledger the agent's tools cannot UPDATE; give the agent only the grant id.
4. On every risky call: load the grant → reject if missing, expired, or consumed → confirm the live threshold still matches what was approved → then run. If anything drifted, fail closed and open a new approval.
5. Run an expiry sweeper (or rely on a store that returns 410/expired): when TTL hits, restore the safer default automatically — do not wait for a human to notice the raised ceiling is still on.
6. Log approve, deny, expiry, and re-approval events with actor, grant id, before/after values, policy_version, and expires_at so you can audit which authority was live.
7. Disable standing alwaysApprove / bypass modes for money, delete, deploy, and outbound send; those need fresh, timed approvals even if a lower tier stays auto.
8. Re-check at execution time, not only when the threshold was raised: a yes from this morning is not a warrant after the policy file or spend cap changed.

Why thresholds that never expire drift

A one-time "raise the auto-approve ceiling to $500 for this incident" becomes standing authority if nothing turns it back down. The next week the agent still spends under yesterday's emergency rules.

• OpenAI's Agents SDK human-in-the-loop flow pauses on interruptions and resumes from a serialized RunState; the docs do not ship a built-in approval TTL. A paused run waits until your app approves, rejects, or you add an expiry sweeper that rejects stale interruptions.
• Claude Code re-evaluates permission rules on each tool call (deny → ask → allow), and /permissions edits apply from the next call in the same turn — which only helps if raised exceptions themselves carry an end time your runner enforces.
• Cursor Run Modes (Auto-review / Allowlist) evaluate each shell, MCP, and Fetch call before it runs. That is per-call gating, not a substitute for expiring an elevated spend or risk tier you set in your own policy store.

Timed re-approval as the default pattern

Raise → approve with TTL → operate under the grant → expire back to the safer default → ask again if still needed. Same pattern for temporary tool allowlist additions and temporary merchant unlocks.

• Rightshold's request_human_approval accepts expires_in_minutes (1..43200). Deciding after expiry fails closed (approval_expired); you open a new request rather than stretching the old yes. verify_human_approval fails if the action hash no longer matches.
• Pair the approval with record_ai_run when you need a signed receipt of the threshold change (hashes of before/after policy, actor, expires_at) that a reviewer can verify later with verify_ai_run.
• Stamp policy_version on the grant. If someone edits spend caps or deny rules while the grant is live, bump the version so in-flight raised thresholds fail closed instead of silently following the old emergency yes.

What can go wrong?

alwaysApprove / "remember this choice" for a high-risk tool never gets cleared after the incident.

• The only copy of raised_ceiling=500 lives in the agent's session JSON and is reused after expiry because nothing checks wall-clock time.
• Expiry deletes the parked run instead of rejecting the grant and re-notifying — reviewers who answer a few minutes late lose the whole job (expire the token; keep the work and ask again).
• You log allows but not expiries, so an auditor cannot tell whether the agent spent under a still-valid raise or a lapsed one.