Is a role-based permission check enough to model approvals?

No. A role permission answers whether this role may approve anything of this type. Delegated approval asks a narrower question: may this person approve this request, now, at this amount and risk?

Role checks miss at least four conditions that appear in routine approvals:

- **Monetary limits.** A role may approve invoices, but only up to a threshold, and sometimes only cumulatively per period. - **Risk conditions.** A request involving a new supplier, a high-risk jurisdiction or a high-severity claim may need a different approver at any amount. - **Delegation and acting arrangements.** Authority can be lent for a date range and withdrawn, which the base role does not show. - **Separation of duties.** The person who raised or edited a request often cannot approve it, even with the right role and limit.

For an environment builder, the practical consequence is that a permission-only simulation produces agents that learn a shortcut: if the tool call succeeds, the action was right. A better environment lets some tool calls succeed technically while being invalid under policy, and records the difference.

A task pack can include cases where the permission system allows the action but the authority matrix does not. That gap is where useful evaluation signal sits.

Everything MirrorFirm produces here is generated. Buyers should check that the generated policy logic is internally consistent, and treat any resemblance to a real organisation's rules as something to inspect rather than assume.