This is the part I keep coming back to: approval is only one boundary. For agent-built products, the other boundary is the budget and payment state. The agent should know who is paying, what each action costs, and whether a retry is safe before it calls the next tool.