A credential changed after approval
Explain why an approved action can still be refused after credential revocation or destination-binding changes.
Approval records permission to attempt a particular request. It does not preserve access to a credential that an operator later revokes, or override a destination restriction tightened before dispatch. Your application needs to report those later checks rather than describing approval as guaranteed execution.
Anlyon executes the approved request snapshot using credentials bound to the action. Credential availability and destination bindings are checked again at dispatch. The request snapshot does not contain a permanent copy of a revoked secret.
Separate the two credentials
The agent holds an Anlyon credential or authorized session. The provider credential is held separately for the hosted action. Revoking the requesting credential and revoking the provider credential are different interventions. Record which one changed and when.
| Change | What to investigate |
|---|---|
| Requesting key revoked | Whether dispatch was refused before the provider call |
| Secret removed or rebound | Credential availability and allowed destination |
| Provider key revoked externally | Provider response and effect evidence |
| Action edited | Action-version change, independent of credential rotation |
Do not collapse these cases into "the approver rejected it." The reviewer may have approved correctly while the environment changed afterward.
Recover without broadening access
Read the refusal or failure evidence first. Restore only the intended credential and destination configuration, then establish whether a fresh preview and approval are required. Keep the original request available for comparison. A different provider account or action target deserves an explicit review.
Avoid granting a wildcard destination binding as a temporary fix. Also avoid moving the provider secret into the agent runtime to bypass the failed hosted call. That creates a separate execution path outside the control being repaired.
Exercise the sequence in staging
Create a request that waits for approval. Revoke or rebind the relevant credential before dispatch, then inspect the refusal. Repeat with the normal credential restored and a fresh review. Record whether the provider saw any request; a UI status alone is insufficient evidence.
Use secret bindings and dispatch-time approval checks. For scheduled maintenance, follow credential rotation.