Capture what the reviewer sees
Create the approval request from the validated action. For a refund, show the charge identifier, amount, currency, requester and account. Keep a stable reference to the normalised request so the executor can compare the reviewed action with the operation it will send.
Record who reviewed the request, when they reviewed it, and when the decision expires. Check that the reviewer has authority over that action and resource.
Validate again at execution
Verify the request still matches the approved action. Reject an approval copied to a different resource or amount. Re-evaluate policy and reviewer authority as needed when scopes or roles can change during the wait. An expired approval returns the request to review if it is still valid.
Keep a stable operation ID and use downstream idempotency where available. For concurrent submissions, ensure only one can claim the operation. If a call times out after submission, reconcile before retrying a side effect.
Exercise the negative cases
Test an edited amount, an expired approval, a reviewer without authority and two submissions that arrive together. For each test, verify the downstream result and inspect the audit trace. Keep approvals separate from execution records so a granted approval cannot be mistaken for a completed action.