Part 1 of 4 · 1 min read
Overview
An agent that has been manipulated (module 1) will try to turn approvals into a loophole: approve something small, then execute something big. Interviewers ask "how do you make human approval trustworthy?" The answer is binding, single use, separation of duties and a prompt the model cannot write.
About the example, and what is real
Real: the signing service, executor, naive gate, renderer, the 10 plus 4 attack runs and the 20 test cases in code/mini-approvals; timings (about 30 microseconds for issue plus verify on this machine). Assumed: attack lists are my own; the key is a fixed demo value in tests; time is an integer. Not real: no real approval UI, identity provider, key management or distributed nonce store; HMAC with one shared key means the executor could also forge approvals, so production systems often use asymmetric signatures or a separate approval service.