[rwmj]

Some ssh agent implementations do this, notably the one built into Android ConnectBot can be configured to request confirmation each time it is asked to authenticate. Unfortunately ssh-agent (from OpenSSH) does not as far as I know. It's happy to authenticate as many times as requested without any notification.

[DBFFD990]

It can, and it's determined per key when added to the agent.

Look for -c here: https://man.openbsd.org/ssh-add

[rwmj]

Indeed it is - I even checked the man page before posting the comment and completely missed that option.