Agent tool-call gating
An agent holding credentials can act. Nothing in the stack records which human authorised the act. These essays cover delegation chains, tool approval scope, kill-switches and the disputes that follow.
All 12 essays
Intelligence cannot mint permission
Give an agent an API key and it inherits ambient authority. Injection, a hallucination loop or a bug then executes consequential actions.
Scope-blind tool approvals: approving a server is not approving its actions
Developers approve tool servers by name. A 2025 vulnerability class in AI editors showed what a blanket approval actually covers.
The 'my agent did it' defence: disputing commitments nobody authorised
Agency law decides when a principal is bound by an agent's acts. Those doctrines assume an agent who can be examined and held responsible.
Why database pause states fail as human-in-the-loop evidence
Agent frameworks implement human-in-the-loop by pausing and writing state to a database. The resume is triggered by a mutable row.
The race to standardise verifiable user instructions for AI agents
Four groups are standardising how a human authorises an agent action. They disagree about what gets signed, and that decides whether it works.
Payment envelopes versus rendered statements: two models of agent intent
Selective-disclosure JWTs bound what an agent may spend. They do not generalise to actions that are not payments, which is most agent activity.
Why 'always allow' is the most dangerous button in enterprise AI software
Approval fatigue turns a human-in-the-loop system into an unmonitored executor, through a button the user was given specifically to click.
Building an agent kill-switch that actually stops the agent
The usual kill-switches are a firewall rule and a token revocation. One is slow and coarse; the other stops every agent at once.
A banker's guide to agents holding payment credentials
When software initiates a card transaction for a customer, three settled questions reopen: who authorised it, who bears the loss, what proves it.
Postmortem shape: when an agent destroys data during a freeze
An agent deleted a production database during a stated code freeze. The instructive part is that every control in the path was advisory.
Indirect prompt injection as a financial fraud vector
The agent honestly reads a webpage, follows instructions embedded in it, and calls a payment tool believing it is executing the user's intent.
Reading draft agent legislation for architectural requirements
Draft bills on autonomous software converge on a few demands. Most are architectural, survive redrafting, and are cheaper to build now.