You approve a $48 refund.

The agent continues working. It reads another message, rebuilds the tool arguments, and submits $480.

Somewhere in your application, approved is still true .

That is a very small boolean carrying a very large assumption.

The interesting failure here does not require a malicious model. A stale UI, a retry, or an ordinary mutation can produce the same mismatch. The human reviewed one operation. Your code executed another.

Approval needs an object to belong to.

This is the idea behind the bound confirmations in Module 3 of Ship a Safe Agent . For this article, I built a separate, small TypeScript example that makes the boundary visible. No model account. No real refunds. Just a proposed action and a gate we can try to break.

What exactly did the person approve?

Start with the screen the human sees.

If it says “Allow the agent to continue?”, the application has left the scope of that permission ambiguous. Continue reading? Continue issuing refunds?…