Approval
Approval already claimed
One decision, one execution. A second call needs a second decision — this is what prevents replay.
- Approvals
- 3 min read
Claimed atomically
When an approved request executes, the approval is claimed in the same atomic operation. There is no window in which two concurrent retries could both find the approval available and both proceed.
That matters for agents that retry aggressively, and for anything running more than one worker.
Why single-use
An approval that could be used repeatedly would be a permission with extra steps. The reviewer looked at one request and said yes to that request. Anything else is a decision they did not make.
An earlier build compared two different hashes when deciding whether a call was executing, so the one-time claim never ran and an approved request stayed replayable. It is now tracked per Ability and covered by regression tests. If you see a replay succeed, that is a security report — see responsible disclosure.
What to do
Decide whether the second call should happen. If yes, review it as a new request. If the agent is calling repeatedly because it did not register the first success, that is a bug in the agent — the record will show the first call completed.
Approvals
Keep the boundary while you fix the problem.
A good fix restores intended behaviour without creating a second path around WordPress or the governed request lifecycle.