Human approval is not a security boundary unless it is bound to the exact action being approved, enforced at execution time, and protected against replay.

An AI agent is about to issue a ₹25,000 refund.

It has checked the order, confirmed the customer’s identity, validated the refund amount, and requested human approval. A support manager reviews the request and clicks Approve.

Everything looks correct. Then the agent replans. Perhaps it receives new information from a tool. Perhaps a retry changes the execution path. Perhaps another workflow updates the order. Or perhaps the model simply produces a different tool call after the approval has already been granted.

The new request is for ₹75,000.

The agent still has an approval associated with the original refund. If the application checks only whether the action type was approved, it might execute the new request using the old decision.

No prompt injection is required. No sophisticated exploit is necessary.…