Binding User Approval to Individual Actions in Tool-Using Agents

Tool-using agents often ask users to approve an action before executing it. However, when an identical action is proposed again, matching the tool, target, and arguments does not establish which proposal was approved. We introduce EpochSelect, a runtime contract and reference adapter that bind approval to a specific action instance: the tool's preview path must create the instance before approval, approval can only select exactly one existing live instance, and execution rechecks its live state and final arguments. Under explicit synchronous-execution and trust assumptions, the contract prevents approval and execution evidence from being combined across different instances. In 480 matched in-process restoration tests, full instance binding accepts all 120 exact restorations and rejects all 360 nonexact rebindings, avoiding the valid restorations blocked by the object-identity baseline and the invalid substitutions admitted by the value-matching baseline. Language-level evaluation reveals a complementary limitation: on 128 proxy turns from benchmark training data with real tool handlers and preselected proposals, a repaired approval rule rejects all 64 negative cases but accepts only 25 of 64 positive cases (39.1%), each executed exactly once. These results support instance-level approval binding in the tested setting, while leaving natural-language target resolution and end-to-end task effectiveness unestablished.