When two of our agent sessions were working in the same repository, we drew the boundary by having each declare up front which files it was permitted to touch, and by limiting each side's commits to those paths. The approval half we enforce at the send moment rather than the approval moment - the gate binds an owner approval to the exact draft text and rejects the whole batch if a draft changed after it was approved. Your line about an approval being evidence about one specific action is what reframed that for me: I'd been filing the re-check under defensive plumbing, when it's closer to the thing that makes the transfer of authority mean anything.