8 min read
Every Yes Now Has an Expiry Date
Think of a weekly campaign report that an agent assembles every Monday, pulling performance from a customer engagement platform and pipeline from the CRM through two MCP connectors. The first time it ran, someone approved each tool and chose “always allow”, because nobody wants to click through the same prompts every week. That approval was a decision. By the fortieth Monday it has become an assumption, and nobody remembers who made it or what the connectors could do at the time. This week two vendors shipped three controls that treat that drift as a problem to design for.
TL;DR
- Scheduled agents’ tool approvals can now expire. Claude Desktop’s
mcpScheduledTaskApprovalLifetimeDayssets how many days a scheduled task may reuse a lasting MCP-tool approval before it asks again, and zero removes the lasting option. - Google put a clock and a chain of custody on standing access. Workspace admin roles can revoke themselves at expiry, and transferring a shared Gemini Enterprise agent disables its schedule and event triggers until the new owner turns them back on.
- Two ChatGPT defaults moved the other way. New Health connections default to “Allow low-risk actions”, and ChatGPT for Word is enabled by default for Enterprise and Edu from 1 October.
- Cheaper frontier models make the approval question more pressing. Claude Opus 5.5 and GPT-6 Sol and Luna cut prices on 22 September, with the largest savings on cached input.
Approvals that expire
Claude Desktop v2.7032.0 added a managed setting, mcpScheduledTaskApprovalLifetimeDays, that “limits how many days a scheduled task in Cowork or the Code tab may reuse a lasting MCP-tool approval before it asks again”. Setting it to zero removes the lasting option altogether, and the changelog notes that the lasting option is offered even where persistent tool approvals are otherwise turned off. The effect is that a scheduled agent’s permission to use a tool gains a shelf life chosen by the organisation, after which a person has to look again.
Google made the same move one level up. Workspace now lets administrators assign admin roles for a defined period, to users, groups or service accounts, and “Once the expiration time is reached, the access granted by the role is automatically revoked.” Google frames it as reducing standing privileges and ambient access, which is the vocabulary security teams already use for human administrators and have not yet applied consistently to agents.
The third piece is about ownership. Gemini Enterprise administrators can now transfer ownership of a shared agent built by an employee who is leaving or a contractor handing over. Each agent has one owner; the previous owner keeps access as a user. And the detail that makes it a governance feature: “If the transferred agent has a schedule trigger or event trigger, the transfer operation marks them as disabled schedules or events. The new owner must enable it before being able to use the agent.” An agent that runs on its own does not keep running on someone’s behalf after that person has let go of it.
Put together, these describe a shift I think is overdue. For two years the governance question around agents has been framed as a gate: may this agent use this tool, yes or no. What the three controls add is a clock and a chain of custody. The approval is still a gate, but it now expires, and when the person behind it changes, the automation stops until someone new says yes. For marketing teams that are building scheduled agents against customer data faster than IT is reviewing them, that is the difference between a permission model and an inventory of old decisions.
Defaults that went the other way
Not every default moved towards more review, and the record should hold both directions. A first full read of OpenAI’s help-centre release notes, which the previous edition had not covered, found two changes in the other direction.
For new Health connections in ChatGPT, the default permission now follows the user’s global plugin setting, “Allow low-risk actions”, so ChatGPT can use connected health information without asking each time, except for sensitive actions. OpenAI’s reasoning is empirical: more than 70% of Health users already chose that setting. And for Enterprise and Edu workspaces, ChatGPT for Word arrived with an administrator switch and a date: “Starting Oct 1, 2026, Word access will be enabled by default.”
Neither change is unreasonable. A default that most users override is friction without protection, and a document assistant in Word is squarely what enterprise customers asked for. The point for anyone running a workspace is simpler than a judgement on either: a default is a decision someone else makes for you on a date you did not pick. If your organisation has not decided whether ChatGPT belongs in Word, the calendar will decide on 1 October. Google did something similar in Gemini Enterprise, where Gemini 3.8 Flash is now generally available and enabled by default, with a toggle for administrators who want it off.
The loopholes that got closed
The less visible half of the week was a set of fixes that close gaps where a tool did more than its configuration said it should. They deserve a paragraph because they are the evidence that the expiry controls above are part of a wider pattern.
Claude Desktop v2.2553.0, dated 17 September and recorded in the Week 39 AI Watch as a late capture, fixed “a routine created with every connector removed still using all of your connectors”, and a case where Plan mode skipped permission prompts when the Bypass permissions option was on and the session fell back to an older bundled command-line tool. The same build added a setting that restricts which plugin-provided MCP servers may connect, where an empty list allows none. Version v2.7032.0 then removed a temporary exception in custom connector validation, so authorisation server metadata whose issuer does not match its own URL fails validation again.
Google’s Antigravity 2.16.0 fixed something subtler that I think matters for anyone generating interactive content with an agent: prompt actions inside interactive widgets and HTML artifacts now fill in the message box instead of sending automatically, “so you can review or edit the prompt before submitting it”. Generated content that could press send on your behalf is precisely where a person should look first. The next release, 2.17.0, made plan review a named setting, Plan Review Policy, which can require review of every plan, leave it to the agent’s judgement, or skip review entirely. Whatever a team chooses, the choice is now visible in settings rather than implicit in behaviour.
Cheaper frontier models, same governance questions
Anthropic released Claude Opus 5.5, which it describes as performing “at the level of Claude Fable 5.1 on most work” and costing 40% less to run than Opus 5 on typical workloads, priced at $4 and $20 per million input and output tokens. OpenAI released GPT-6 Sol and Luna at half the price of their GPT-5.6 predecessors’ promotional rates. Each announcement benchmarks the other vendor’s models, and I will leave the benchmarks where they are; both vendors’ pages carry the tables and the caveats.
The number I would look at for agentic marketing work is caching. Opus 5.5 prices cache reads at $0.20 per million tokens, 60% less than Opus 5, and OpenAI shipped caching improvements for GPT-6 with a 90% discount on cached input and explicit control over where cached prefixes end. Long agent sessions spend most of their budget rereading the same context: brand guidelines, product catalogs, prior campaign results. That is where the cost of running content and data workflows sits, and it is falling faster than the headline token price.
Two statements in the Opus 5.5 announcement connect back to the rest of this piece. Anthropic calls it its “first release since we called for pacing the frontier”, and says the model is “much less likely than recent models to take hard-to-reverse actions or act outside the boundaries it’s been given”. OpenAI, for its part, published principles for third-party assessments of safety claims. Both are claims about the model. The controls in the first section are about the deployment, and in my reading they are the part an enterprise can verify for itself.
Verdict
A cheaper, more capable model makes it easier to run more agents on more schedules against more customer data, which is exactly the situation in which approvals quietly outlive the people and decisions behind them. The week’s most useful releases were a setting with a number of days in it, a role that revokes itself, and an agent that stops when its owner changes. None of them is dramatic, and all of them turn a one-time yes into a recurring one.
Agent governance is becoming a calendar, not a checkbox: decide how long each yes should last before a default decides for you.
Sources
Anthropic
- Claude Desktop changelog. Source for mcpScheduledTaskApprovalLifetimeDays and the OAuth issuer validation change in v2.7032.0 (22 September), and for allowedPluginMcpServers, the routine connector fix and the Plan mode fix in v2.2553.0 (17 September).
- Claude Opus 5.5. Source for the performance and cost claims, pricing, cache-read pricing, the pacing statement and the boundary statement.
- Assign temporary administrator roles in the Google Admin console. Source for time-limited admin roles and automatic revocation.
- Gemini Enterprise release notes. Source for agent ownership transfer (21 September) and Gemini 3.8 Flash enabled by default (23 September).
- Google Antigravity changelog. Source for the widget and artifact prompt-action change in 2.16.0 and Plan Review Policy in 2.17.0 (both 22 September).
OpenAI
- ChatGPT release notes. Source for the Health connection default of 14 September.
- ChatGPT Enterprise and Edu release notes. Source for ChatGPT for Word and its 1 October default.
- Introducing GPT-6 Sol and Luna. Source for pricing and the GPT-6 caching improvements.
- Priorities and principles for effective third party assessments. Source for the third-party assessment principles and the definitions of safety claim and safety case.
The record
- AI Watch, Week 39. Every date, status and late capture referenced in this essay.
- Weekly MarTech Signals That Matter to Me: Part 21, Week 39. The same week on the customer engagement beat, where Iterable and Braze moved consent and agent access to the individual.
The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the interpretation.
This article draws from the AI Tools Weekly Digest scans run on September 24, 2026, covering release notes and product updates across the major agentic work platforms. The dated record behind it is in AI Watch, Week 39.
If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.
