Recover from an expired action approval
Distinguish an expired preview from an expired approval, then refresh the request without reusing an outdated decision.
An approval arriving late should not silently authorize a newly constructed request. The reviewer approved an operation with an expiry and particular observed state. When that window closes, obtain a fresh preview and a fresh decision if policy requires one.
In Anlyon, a governed action's approval does not outlive its preview. Expiry can be detected when an invocation arrives or later during dispatch. These paths leave different records, so the first troubleshooting step is to identify where the operation stopped.
Identify the failure stage
| Event | Documented result |
|---|---|
| Invoke with an already expired preview ID | HTTP 409 PREVIEW_EXPIRED; no effect created |
| Preview expires between admission and dispatch | Refused effect, nothing dispatched |
| Approval expires before a decision | Refused rather than denied |
A denied approval means a decision rejected the operation. Expiry means the decision window closed. Keeping them separate makes review-queue metrics and agent messages more useful.
Refresh the whole review context
Read the original request and confirm the business task is still wanted. If a refund is no longer appropriate, stop. If the task remains valid, create a fresh preview from the intended input. Show the new expiry, current target and any provider state observation to the reviewer. Do not copy the old approval identifier onto the new request.
The original business operation may already have a persisted identity. Inspect its state before selecting how to represent the replacement attempt. Do not generate arbitrary fresh operation keys merely to bypass an error; first establish that no earlier effect was dispatched.
Reduce repeated expiry
Measure the time spent waiting for review and the reasons requests arrive late. Route clearly forbidden work to deterministic denial, and use the review queue for decisions that need judgment. A longer approval window changes freshness risk; it does not ensure a reviewer sees current provider state.
Test expiry using a controlled environment and inspect whether an effect exists. An application that assumes every error has a receipt will otherwise fail on admission errors.
Read bound approvals, then design the review screen. The operation-key guide explains why recovery should preserve business identity deliberately.