Agent Step-Up verifies the signed effect instead of a mutable approval narrative

Approval text and the action finally executed can diverge if an agent is allowed to describe a transaction and later supply its parameters. Agent Step-Up studies that gap by moving both rendering and effect confirmation into a separate gateway. The gateway fixes the actor, destination, operation and arguments in a canonical descriptor, shows those stored values to the approving user, and validates a signature over the descriptor before dispatch. Signing only a conversation or an agent-written explanation would not prevent parameter substitution.

The paper audits ten agent runtimes and reports that none produced a third-party-verifiable approval record. Four of eight relevant systems permitted some tested postapproval mutation, while seven evaluated systems lacked a flood cap. Its prototype uses scripted cases, attack pairs and formal analysis, including 27,108 scripted executions and 609 adversarial pairs. In the reported forged-narrative experiment, success fell from 54% to 3%. These results measure a designed confirmation gateway, not universal human behavior or certified production deployments.

Approval fatigue remains a distinct failure mode. Modeled repeated confirmations still resulted in 45% to 60% successful attacker approvals under the paper's settings. A cryptographically correct descriptor can bind exactly what will run without establishing that the user has made a good decision or that the destination should have been trusted. A practical audit must therefore test the immutable request, the trusted display, the one-time signature, the execution receipt and the actual downstream side effect separately.