## TL;DR
The agent must never be the approver of a request it created or benefits from. Require a human approver who is not the requester, block self-approval in code, and log every emergency grant with both identities.

## Steps
1. Add a rule that rejects any approval where the approver equals the requester.
   Expected: Self-approval is impossible by construction.
2. Route emergency requests to a human approver outside the requesting chain.
   Expected: A second person always decides.
3. Log the requester, approver, scope, and expiry for every emergency grant.
   Expected: The audit shows the separation.
4. Test with the agent as requester and confirm the approval is refused.
   Expected: The guard holds.

## When to use
- The agent participates in emergency or break-glass access
- Approvals can be executed by automation
- Compliance requires separation of duties

## When not to use
- All approvals are manual by policy
- The agent only notifies and never approves
- Emergency access does not exist in the environment

## Why this happens
Emergency access exists for speed, which tempts automation to close the loop entirely: the agent requests, the agent approves, nobody knows. That converts a controlled break-glass into an unmonitored backdoor.

## Edge cases
- The human approver must be reachable fast, or the guard becomes a denial of emergency access.
- Time-box every emergency grant so a forgotten approval does not linger.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_NYpF-r1s2dWgaavPGtaadA