Execution safety, control 2 of 9
S-02 Bind approvals to exact high-impact actions
P0Hard gateNeeds your evidence
High-impact writes require explicit approval of the exact scope and candidate. The agent cannot approve itself or reuse approval after the reviewed payload changes.
- Priority
- Gate. A FAIL stops publish or launch.
- Hard gate
- Yes. A FAIL stops publication, whatever the score.
- Change class
- APPROVAL_REQUIRED: Required exact authority must be valid before the consequential action.
- Quality bucket
- Not scored: hard gate only
Evidence to review
- Approval from a trusted channel, payload digest match and expiry/revocation checks.
How to implement
- Bind approval to action ID, site, environment, candidate digest and expiry.
- Require a fresh decision for robots, redirects, DNS, pricing, legal claims, mass publishing and external submissions.
- Accept narrow pre-authorisation only from a trusted owner policy.
- Keep prohibitions non-overridable.
- Bind the affected-URL inventory, cohort, optimisation rationale and rollout stage into the approved action; a changed manifest invalidates old approval.
How UltimateSEO checks this
Needs your evidence. No automated check covers this control, so it stays UNKNOWN until evidence is supplied.
States used: PASS, FAIL, UNKNOWN, NOT_APPLICABLE or BLOCKED. UNKNOWN is never shown as a pass. How states work.
Part of The UltimateSEO Framework v4.3, catalogue dated 2026-10-14. Evidence states, control states and the publish gate are explained on the hub.