Durable approval is not the same as valid approval

A few weeks ago we shipped a general command tool for a local agent, with a deny-list in front of it...