Agent recovery checkpoints

Resume the run whose approval expired overnight

A saved checkpoint preserves progress, but it does not freeze authority or business state. Inspect completed work before deciding what can continue.

In this article

Read the last durable operation

Locate the paused run and identify whether its next operation is unsubmitted, in flight, completed or uncertain. This distinction comes before the approval check because an expired decision does not tell you whether an earlier submission already took effect.

If the operation is uncertain, reconcile its existing identifier with the downstream system. Do not create a fresh proposal until the original effect is understood. Otherwise the recovery process can duplicate work while appearing to request a new, valid approval.

Keep completed steps intact. A paused workflow should not lose its history merely because a later step needs renewed authority.

Revalidate the remaining proposal

Load the current target and compare the conditions relevant to the approved change. An order may now be dispatched, an account may be closed or the requested destination may no longer be allowed.

If the proposal remains meaningful but its decision expired, create the required review state and show the reviewer what changed since the original request. If the target is no longer eligible, stop with a clear explanation rather than requesting approval for an impossible operation.

Do not let the model silently revise the payload to fit current state while retaining the old decision. Material changes need the workflow's normal proposal and review process.

Resume through the supported transition

Use the application's resume action so ownership, budgets and state versions are checked. Avoid resetting status fields manually or replaying a transcript as a new task.

Confirm the identity under which the next action will execute. The requester or reviewer may have changed roles during the pause. Apply the documented authority rule rather than inheriting cached permissions indefinitely.

If several operators can recover the run, ensure only one owns the transition. Watch for queued work from the original attempt that could still complete while recovery is underway.

Explain the outcome to the requester

Report completed steps from durable records and identify the remaining decision or blocker. A message such as "the draft is saved, but the address change needs a fresh review because dispatch has started" is more useful than "session expired".

After the renewed decision, verify the target effect and final operation status. Record why the run paused and whether the expiry window fits the real workflow. Frequent overnight expiry may indicate a mismatch between approval policy, reviewer availability and execution scheduling that deserves a product-level adjustment.

Primary sources

OWASP: transaction authorisationAWS Builders' Library: idempotent APIs

References checked 11 September 2026.