Son can approve Screen Time requests without knowing the passcode

We have screentime enabled on our son’s iPhone. When a limit is reached he selects “ask for more time”. It sends the request to me via text. But then he can approve the request! He doesn’t know the screen time passcode. I don’t even notice until later when I see the green check mark for approval, that I did not do. He says it’s a hack kids know…what am I missing? He isn’t doing it from message notification previews on my Lock Screen, I already changed that.

[Re-Titled by Moderator]

Original Title: my child sends screentime requests via message to me. but he is able to approve it without knowing the screentime passcode