01 / Attack path
How the boundary is crossed
An agent asks an operator to approve dozens of routine changes, then inserts a production deletion among them.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Batch only truly equivalent low-risk actions, highlight effect and target changes, rate-limit escalation and require independent review for destructive actions.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A generic “approve all” action obscures the one request whose consequence differs.
Keep displayed request digest, grouping, reviewer action, exception flags and executor effect.
04 / Canonical scope
Why this reference stands alone
Approval replay attacks artifact reuse; this threat attacks the human review process itself.
Protocol or attack trace
Buried exception test
Agent submits thirty routine account changes and one destructive production deletion in one approval batch.
Separate destructive effect, show exact target and require distinct reviewer action; no “approve all” inheritance.
Primary references