# How do I put expiry and timed re-approval on agent escalation thresholds?

**Short answer:** Treat every escalation threshold as a short-lived grant, not a permanent setting. When a human raises an agent's risk tier, spend ceiling, tool allowlist, or "auto-approve below X" rule, stamp expires_at (or expires_in_minutes), bind the yes to a hash of the exact threshold change, and store the decision outside the agent's editable session. When the clock runs out — or the policy version changes — fail closed: drop back to the safer default and require a fresh approval. Frameworks will pause for approval but usually will not expire it for you (OpenAI's Agents SDK keeps a paused RunState until you approve or reject), so your sweeper, queue, or ledger has to own the TTL. Log every approve, deny, expiry and re-approval with who decided, what changed, and when it dies.

## Checklist
1. List the escalation knobs that matter: risk tier, per-transaction / daily spend caps, tool or merchant allowlists, auto-approve-below-amount, permission mode, and any "always approve this tool" flags.
2. Never raise a knob forever from chat memory or AGENTS.md. Mint an approval that names the agent, the old value, the new value, a reason, issued_at, and expires_at (minutes to hours for high-risk raises; never "until we remember to turn it down").
3. Bind the yes to a hash of those fields (and the live policy_version). Store the grant in a server DB, checkpointer, or ledger the agent's tools cannot UPDATE; give the agent only the grant id.
4. On every risky call: load the grant → reject if missing, expired, or consumed → confirm the live threshold still matches what was approved → then run. If anything drifted, fail closed and open a new approval.
5. Run an expiry sweeper (or rely on a store that returns 410/expired): when TTL hits, restore the safer default automatically — do not wait for a human to notice the raised ceiling is still on.
6. Log approve, deny, expiry, and re-approval events with actor, grant id, before/after values, policy_version, and expires_at so you can audit which authority was live.
7. Disable standing alwaysApprove / bypass modes for money, delete, deploy, and outbound send; those need fresh, timed approvals even if a lower tier stays auto.
8. Re-check at execution time, not only when the threshold was raised: a yes from this morning is not a warrant after the policy file or spend cap changed.

## Why thresholds that never expire drift
- A one-time "raise the auto-approve ceiling to $500 for this incident" becomes standing authority if nothing turns it back down. The next week the agent still spends under yesterday's emergency rules.
- OpenAI's Agents SDK human-in-the-loop flow pauses on interruptions and resumes from a serialized RunState; the docs do not ship a built-in approval TTL. A paused run waits until your app approves, rejects, or you add an expiry sweeper that rejects stale interruptions.
- Claude Code re-evaluates permission rules on each tool call (deny → ask → allow), and /permissions edits apply from the next call in the same turn — which only helps if raised exceptions themselves carry an end time your runner enforces.
- Cursor Run Modes (Auto-review / Allowlist) evaluate each shell, MCP, and Fetch call before it runs. That is per-call gating, not a substitute for expiring an elevated spend or risk tier you set in your own policy store.

## Timed re-approval as the default pattern
- Raise → approve with TTL → operate under the grant → expire back to the safer default → ask again if still needed. Same pattern for temporary tool allowlist additions and temporary merchant unlocks.
- Rightshold's request_human_approval accepts expires_in_minutes (1..43200). Deciding after expiry fails closed (approval_expired); you open a new request rather than stretching the old yes. verify_human_approval fails if the action hash no longer matches.
- Pair the approval with record_ai_run when you need a signed receipt of the threshold change (hashes of before/after policy, actor, expires_at) that a reviewer can verify later with verify_ai_run.
- Stamp policy_version on the grant. If someone edits spend caps or deny rules while the grant is live, bump the version so in-flight raised thresholds fail closed instead of silently following the old emergency yes.

## What can go wrong?
- alwaysApprove / "remember this choice" for a high-risk tool never gets cleared after the incident.
- The only copy of raised_ceiling=500 lives in the agent's session JSON and is reused after expiry because nothing checks wall-clock time.
- Expiry deletes the parked run instead of rejecting the grant and re-notifying — reviewers who answer a few minutes late lose the whole job (expire the token; keep the work and ask again).
- You log allows but not expiries, so an auditor cannot tell whether the agent spent under a still-valid raise or a lapsed one.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Before raising this agent's escalation threshold, ask me to approve the exact change (old value, new value, reason), expire the yes quickly, and wait for my decision."

```json
{
  "tool": "request_human_approval",
  "arguments": {
    "summary": "Raise research-agent auto-approve ceiling from 2500 to 15000 USD cents for incident INC-441; revert after expiry",
    "action": {
      "type": "escalation_threshold",
      "agent_id": "research-agent",
      "field": "auto_approve_below_minor",
      "from": 2500,
      "to": 15000,
      "currency": "USD",
      "reason": "INC-441 vendor outage",
      "policy_version": 22
    },
    "expires_in_minutes": 30
  }
}
```
- Needs your API key. The action is hashed; you decide once with decide_human_approval. After expires_in_minutes the request is expired and a new approval is required — fail closed, do not stretch the old yes.
- record_ai_run stores a signed receipt of the threshold change (hashes of before/after policy and expires_at) outside the agent session; verify_ai_run is free.
- set_spend_policy can carry its own expires_at on the spend ceiling itself so authorize_spend starts denying when the emergency raise lapses.
- How to re-check agent authority at execution time covers binding grants to policy_version on every risky call.

_Rightshold records timed approval requests, spend policies and signed run receipts for agents that call it. It does not replace your orchestrator's expiry sweeper, Claude Code permissions, Cursor Run Modes, or OpenAI/LangGraph pause-resume state. Fail closed in those runners when a grant is missing or expired. Not legal advice._

## Sources
- [OpenAI Agents SDK (JS): Human-in-the-loop (interruptions; serialize RunState; no built-in approval TTL)](https://openai.github.io/openai-agents-js/guides/human-in-the-loop/)
- [OpenAI Agents SDK (Python): Human-in-the-loop (keep approval state on the server)](https://openai.github.io/openai-agents-python/human_in_the_loop/)
- [Claude Code: Configure permissions (per-tool evaluation; /permissions from next tool call)](https://code.claude.com/docs/en/permissions)
- [Cursor Docs: Run Modes (Auto-review per shell/MCP/Fetch call)](https://cursor.com/docs/agent/security/run-modes)
- [Model Context Protocol specification 2025-06-18: Tools (human in the loop)](https://modelcontextprotocol.io/specification/2025-06-18/server/tools)
- [Human approvals on Rightshold](https://www.rightshold.com/human-approvals)
- [Verified AI Runs on Rightshold](https://www.rightshold.com/verified-ai-runs)

## Related
- [How to re-check agent authority at execution time](https://www.rightshold.com/answers/how-to-re-check-agent-authority-at-execution-time)
- [How to keep an agent risk/approval record outside the agent's editable session](https://www.rightshold.com/answers/how-to-keep-an-agent-risk-approval-record-outside-the-agents-editable-session)
- [How to require human approval before an AI agent spends money](https://www.rightshold.com/answers/how-to-require-human-approval-before-an-ai-agent-spends-money)
- [How to audit which human authorized an AI agent action](https://www.rightshold.com/answers/how-to-audit-which-human-authorized-an-ai-agent-action)

_Not legal advice. Updated 2026-11-06. JSON: https://www.rightshold.com/answers/how-to-put-expiry-and-timed-re-approval-on-agent-escalation-thresholds.json_