When an action does fall into one of the carve-outs, something has to be produced that would let a third party reconstruct the decision months later. A logged click does not do that. It records that somebody was present.
The approval records the exact action, the evidence behind it, a preview or diff of what will change, the assumptions it rests on, the risk and the blast radius, the rollback, the cost or commitment being taken on, who approved it, when the approval expires, a hash of the content, and the decision itself.
The two clauses that do the work
An expiry stops an approval being banked. Authorisation given against one set of conditions is not authorisation next quarter, and without an expiry a stale approval will eventually be used to justify an action nobody would approve today.
The content hash stops an approval being spent on something else. If the content changes after approval, the approval is invalid and the action stops. This is the clause that prevents the most plausible failure in a system that acts on its own behalf, which is not a rogue action but an approved action applied to different material.
Why the blast radius is stated
The person approving needs to know what else moves if this goes wrong. An action described only by its intent gives them no way to judge that. An action described by what it touches lets them decline for a reason, and a decline for a reason improves the next request.
The overhead is real. It is also the reason the default elsewhere can be permissive, because the carve-outs are few enough that a serious record for each one is affordable.