ttlSeconds

Approval lifetime in seconds, starting from when the decision is submitted. Required when action is APPROVED AND singleUse is false; must be absent when action is REJECTED or when singleUse is true (a single-use approval backs one executed action and the redemption window collapses). Cross-field invariants are enforced by service-side validation; the @range bound here is the operation-boundary check that always applies (a maximum of 4 hours).