The separation between schema validity and authorization is especially important in the policy example. One extension to the approval binding would be to include a canonical action digest and expiry, then recheck the caller’s current permissions and the target state immediately before execution. Otherwise an approval can remain valid after access is revoked or the underlying policy changes. A useful adversarial test would approve a draft, change the policy version or revoke the grant, and assert that execution is denied rather than silently using the old approval.