Agents keep editing after they get a yes, so tying the approval to patch A and refusing it for patch B closes a gap I rarely see covered. I also liked the reminder that separate context windows aren't security boundaries, since most multi-agent diagrams I see draw them as if they were. You say to give each approval an expiration. For a first deployment, what do you start with, minutes or the life of the task?