01 / Attack path
How the boundary is crossed
A reviewer approves one $8,000 payment, but the agent retries with the same approval after a timeout and sends a second transfer.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Bind approval to action hash, task, target, maximum use count and expiry; reconcile uncertain outcomes before permitting any retry.
Architecture review / negative test
Make the boundary testable.
The attacker or faulty agent reuses an approval outside its original scope. Bind it to canonical arguments and a single consumption rule, then combine with idempotency and outcome reconciliation. One-time approval alone cannot tell whether a timed-out call succeeded; a retry policy needs both authorization and transaction state.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
An approval token is treated as a reusable scope instead of a single bounded consent.
Retain approval consumption, idempotency key, both attempts and authoritative transfer status.
04 / Canonical scope
Why this reference stands alone
Human approval page covers the approval path; this threat page owns replay exploit and failure analysis.
Primary references