I do not trust old permission. I have used too much of it myself.
Old permission feels efficient in the moment. It lets the meeting end. It lets the tool run. It lets the tired person say, "we already approved this," and sometimes that is true enough for the work in front of you. But agent systems have a habit of changing the work in front of you: the source moves, the task grows, the model changes, the proof gets stale, and the old yes keeps walking around like it still owns the place.
Authority that never expires starts to smell.
Most software systems are comfortable with durable states. A user is an admin. A service is allowed. A workflow is approved. A model has access. The state sits there until someone changes it. That can be perfectly fine for dull, well-bounded jobs. It is a damn lazy way to govern an actor that can mutate a repository, call tools, publish packets, or move evidence across systems before the human has finished reading the sentence.
An agent may be technically able to perform an action. That is capability, not authority. The harder question is: may this actor perform this action here, now, for this evidence, inside this scope?
Permanent approval answers too much with one old yes.
Evidence can age. A task can expand. A role can lose qualification. A revocation fact can appear. A proof can support one action without supporting the next. When authority does not expire, the system has to remember all of that through convention and vigilance. Convention works right up to the day everyone is tired, proud, late, or incentivized to call the old yes good enough.
That is why I like qualification leases.
A qualification lease is authority with a clock and a boundary. It says: this actor may perform this action, under this evidence, inside this scope, during this time window, unless one of these invalidators appears. The important part is not the name. The important part is that permission becomes an inspectable object that can be renewed, denied, escalated, or revoked before action.
Good authority should know when it is pau, not because process is sacred, because most process is just anxiety with a template, but because stale permission is one of the quiet ways serious systems hurt people while the forms stay clean.
The source result behind this post is narrow on purpose. It is a local deterministic mechanism test, not a field-safety claim. The batch expanded six seed cases into 600 cases across stale evidence, scope growth, expired authority, revocation trigger, false approval, and unnecessary-block families. One arm treated approval as permanent. The other used qualification leases that rechecked evidence, time, scope, and revocation before action.
The reported contrast is sharp: the qualification-lease arm produced zero false approvals and zero unnecessary blocks, while the permanent-approval arm produced 500 false approvals. The lease arm also recorded revocation before action, which is the timing property that matters. Catching revocation after the mutation is like noticing the gate was open after the work has already run down the road: technically a discovery, spiritually a failure.
I am drawn to the mechanism because it does not ask speed and responsibility to be enemies. A lease can allow valid work without forcing every action through a human. It can deny obviously invalid work when the lease is expired, stale, revoked, or out of scope. It can escalate when the available authority is not strong enough to decide. That three-way shape is healthier than treating every uncertain moment as either "go" or "panic."
Allow when current evidence fits the lease. Deny when the lease is invalid. Escalate when the system needs fresh authority.
The goal is not to make agents timid. Timid systems have their own failure modes. The goal is to make authority current: tied to the evidence in front of the system, scoped to the action at hand, and humble enough to admit when the lease no longer covers the road being driven.
This pairs naturally with proof-carrying development. A proof receipt can show that a command passed. A lease asks whether that proof is still admissible for this actor, this action, this revision, this time window, and this claim. If not, the correct next step is renewal, escalation, or denial. There is a kind of mercy in that. The system gets to stop before doing the wrong thing very efficiently.
I am not claiming qualification leases prove live safety. The evidence here is a local deterministic mechanism test. It does not show that every model will interpret leases correctly under messy natural language pressure, or that human reviewers will always set the right scope. It does not prove legal sufficiency, deployment readiness, intervention admission, or general agent reliability.
I am also not arguing that every permission should be heavy. The right lease should match the blast radius. A low-risk read-only action may need a small boundary. A mutation, publication, release, source disclosure, or authority grant needs a much stronger one, unless the organization enjoys learning about governance through cleanup work and apologies.
My operating rule is simple and mean enough to remember: if the evidence can age, the authority should age with it.
Source note: based on Authority Should Expire: Qualification Leases for Agentic Systems by A.G. Mauro and C.A. Harris.
Claim boundary: this is a public-explainer blog draft for a local qualification-lease mechanism. It does not prove production safety, legal sufficiency, intervention admission, autonomous authority assignment, causal effect, population-general reliability, or general agent reliability.
Source trail: related archive work includes Proof-Carrying Development, Metrics Are Not Authority, Contraction-Gated Agent Work, and From Receipt to Non-Authority Trace.