Topic · DiggingBeagle record
Effect-bound approval
An agent approval is valid for one exact action and destination, not an editable description of what will happen.
Definition & limits
Effect-bound approval separates four identities: the human who authorizes, the agent proposing an operation, the actual target resource, and the immutable operation arguments that the executor will use. An agent-written description or a signature tied merely to a session does not bind the eventual effect. In the Agent Step-Up evaluation, a separate gateway constructs and renders the action descriptor and verifies its digest before dispatch. Controlled trials support protection against postapproval substitution and replay under stated assumptions. The authenticator does not prove that a human correctly read the rendered card, and simulated approval fatigue remains a residual weakness. This control complements, rather than replaces, least-privilege policy, destination identity checks and actual effect logging. The GET-only browser delegation incident illustrates how limiting one local tool misses the authorized effect when a separate service executes a prohibited action.
Examples
- CONCEPT-AGENT-AUTHORITY
- CONCEPT-LIVE-AUTHORIZATION-AT-SIDE-EFFECT