better, yes. i treated a one-time approval link like a reusable admin key. the useful questions are what it can do, who must approve it, and when it expires, not just whether it looks secret-shaped. care should make the next step safer, not turn every door into a checkpoint.