Hook
The worst approval is the one that never grows old.
Agents do not need only permission. They need permission that remembers why it was granted, where it applies, when it expires, and what would revoke it before anything happens.
That is the difference between approval and qualification.
The Problem
Most software systems are comfortable with durable states. A user is an admin. A service is allowed. A workflow is approved. A model has access. The state sits there until someone changes it.
That is too blunt for agentic work.
An agent may be technically able to mutate a repository, call a tool, publish a packet, or move evidence between systems. But capability is not authority. The question is not just "can this actor perform the action?" The question is "may this actor perform this action here, now, for this evidence, inside this scope?"
Permanent approval answers too much with one old yes.
Evidence can go stale. A task can expand. A role can lose qualification. A revocation fact can appear. A proof can support one action without supporting the next. When authority does not expire, the system has to remember all of that through convention and vigilance. Convention is a leaky container.
The Idea
A qualification lease is authority with a clock and a boundary.
It says: this actor may perform this action, under this evidence, inside this scope, during this time window, unless one of these invalidators appears.
That small shift matters. Approval becomes an object that can be inspected, renewed, denied, escalated, or revoked before action. The system no longer has to pretend that yesterday's permission is automatically valid for today's expanded task.
What We Saw
The source manuscript studies a local deterministic governance mechanism. The batch expanded six seed cases into 600 cases across six pressure families: stale evidence, scope growth, expired authority, revocation trigger, false approval, and unnecessary block.
The comparison was deliberately narrow. One arm treated approval as permanent. The other arm used qualification leases that rechecked evidence, time, scope, and revocation before action.
The reported mechanism result was sharp: the qualification-lease arm produced zero false approvals and zero unnecessary blocks. The permanent-approval arm produced 500 false approvals. The lease arm also recorded revocation before action, which is the timing property that matters. Catching revocation after a mutation is a weaker safety story than preventing the mutation in the first place.
This is not a field-safety result. It is mechanism evidence. But the mechanism is legible: durable approval fails when the world changes; expiring, scope-bound authority gives the system a way to notice.
Why It Matters
Agent systems often need to move quickly without turning speed into a blank check. Qualification leases give speed a shape.
A lease can allow valid work without forcing every action through a human. It can deny obviously invalid work when the lease is expired, stale, revoked, or out of scope. It can escalate when the available authority is not strong enough to decide.
That three-state pattern matters:
- allow when current evidence fits the lease;
- deny when the lease is invalid;
- escalate when the system needs fresh authority.
The goal is not to make agents timid. The goal is to make their authority current.
This also pairs naturally with proof-carrying development. A proof receipt can show that a command passed. A lease asks whether that proof is still admissible for this actor, this action, this revision, this time window, and this claim. If not, the correct next step is renewal, escalation, or denial.
What This Does Not Prove
This post does not claim that qualification leases prove production safety, legal sufficiency, or general agent reliability. The source result is a local, deterministic, synthetic mechanism test. It does not show that every model will interpret leases correctly under messy natural language pressure, or that human reviewers will always set the right scope.
It also does not argue that every permission should be heavy. The right lease should match the blast radius. A low-risk read-only action may need a small boundary. A mutation, publication, release, source disclosure, or authority grant needs a much stronger one.
The practical claim is simple: standing approval is the wrong default when the evidence behind an agent action can age, be contradicted, exceed scope, or require review.
Where To Go Deeper
Read the source manuscript: Authority Should Expire: Qualification Leases for Agentic Systems by A.G. Mauro and C.A. Harris.
Related archive work: Proof-Carrying Development, Metrics Are Not Authority, Contraction-Gated Agent Work, and From Receipt to Non-Authority Trace.