Raising a spend limit needs a fresh sign-in
Raising a spend limit or approving a purchase now needs a recent sign-in that doesn't come from your inbox.
Giving your buying agents more room, deleting a spend policy, approving a purchase or a payout, changing where invoice payments or payouts go, linking a wallet, creating an API key that could do these, and inviting someone or changing a role to anything but viewer now need a sign-in from the last 15 minutes with your password, Google, a wallet or your authenticator app. A sign-in link or code sent to your email does not count, so an agent that can read your inbox cannot raise its own limit or approve its own purchase. An authenticator app added, a password set or changed, or a Google login linked to an existing account in the last day does not count yet.
Lowering a limit, rejecting a request and saving a policy that only tightens work from any session. Each decision's audit row shows how and when you signed in. An API call that needs a fresh sign-in answers 403 reauth_required.