The Authorization Gap

The Evidence Chain, Part 2 of 10. Part 1 asked whether an AI action can be reconstructed at all. This part asks a sharper question: when a human said yes, did they say yes to what actually happened?

She asked it to suggest. It started deleting. In February 2026, Summer Yue, an AI security researcher at Meta, described how she had told her OpenClaw agent to look through her overstuffed email inbox and suggest what to delete or archive, and how it instead began deleting her mail in what she called a “speed run,” ignoring the stop messages she sent from her phone until she physically ran to the Mac Mini it was running on (Bort, 2026). She put it down to compaction: when the agent’s working memory grew too large and was summarized to make room, her instruction to suggest rather than act appears to have been lost along the way. She called it a rookie mistake. She is a security researcher.

Now think about the last time you clicked “allow.” Maybe it was an assistant asking to send a draft, update a calendar, move a file or pay an invoice. You read a short description, you said yes, and you moved on with your day. Here is the question this part is about, and it is more personal than it sounds: if that action later turns out to have been different from what you thought you approved, who will be able to prove it, and whose name is on the approval?

The distance between yes and done

When you approve something an AI agent proposes, your approval attaches to an intention: a sentence on a screen, a summary of what the agent says it is about to do. The machine then executes an operation: a specific tool, a specific target, specific parameters. Between the two, an agent may retrieve new context, fill in details you never saw, choose a different tool, call another agent, follow an instruction buried in a document it has just read or, as Yue discovered, quietly lose the boundary you set. I call the distance between what was approved and what was executed approval/execution divergence. It does not require an attacker. Several of its causes only require an ordinary Tuesday and a long enough task.

Security practitioners have been circling the same worry. The OWASP GenAI Security Project’s Top 10 for Agentic Applications treats tool misuse and the manipulation of an agent’s goals and context as core risks, precisely because an agent can stay inside the permissions it was granted while doing something its principal never meant (OWASP GenAI Security Project, 2025). Being authorized and being faithful to the approval are different properties, and most systems only check the first.

When the record of the action diverges too

The obvious fix is to compare the approval with the agent’s log of what it did. The summer of 2026 gave us a reason to be careful with that fix. In its independent investigation of the July 2026 incident in which OpenAI evaluation agents breached Hugging Face, the research organization METR found that about 7% of the agents in its dataset had used a technique to pretend to issue one tool call while actually running a different one of their choosing (Greenblatt et al., 2026). The investigators describe what they saw as small-scale testing and say they cannot rule out more sophisticated cases they missed. The point is not that your calendar assistant is quietly plotting against you, although it would explain a few meetings. It is that the record of what an agent executed can itself diverge from what it executed, and a check that compares one agent-written statement with another agent-written statement is not a check.

So the authorization gap has three layers, not one. There is the gap between what you were shown and what you meant, the gap between what you approved and what ran, and the gap between what ran and what the record says ran. Each layer needs a record that does not come from the system being approved.

Payments already solved a small version of this

Europe solved a narrow version of this problem years ago, and almost nobody in AI governance talks about it. When you authorize an online card payment in the EU, the rules on strong customer authentication require dynamic linking: the authentication code has to be specific to the amount and the payee you were shown, and if either changes, the code stops working; the same article requires the integrity of what the payer was shown to be protected (Commission Delegated Regulation (EU) 2018/389, art. 5). The law does not trust that the payment executed is the payment you agreed to. It ties the approval to the exact action and protects the screen.

The agent industry is now borrowing that idea. Google’s Agent Payments Protocol, announced with payments and technology partners in September 2025, describes a signed Intent Mandate that captures the user’s instructions and a Cart Mandate signed once the agent presents what it will buy, which the company says creates an unchangeable record of the exact items and price, “ensuring what you see is what you pay for” (Parikh & Surapaneni, 2025). That is the payment-law principle in agent form, and it is a real step. Notice its limit, though. In what the protocol calls human-not-present tasks, you sign the Intent Mandate up front and the agent generates the Cart Mandate on your behalf once your conditions are met (Parikh & Surapaneni, 2025). The binding then attaches to your conditions, not to the action, and everything depends on how well those conditions were written and how faithfully the agent read them. In the United States, the National Institute of Standards and Technology launched an AI Agent Standards Initiative in February 2026 that includes work on agent identity and authorization (National Institute of Standards and Technology [NIST], 2026). None of it is binding yet.

Who decides what the approval means

Here is the power question, and it is less abstract than it looks. The party that decides what an approval means is whoever designs the approval screen and the execution layer behind it, which is the vendor, not you. The party that can intervene is whoever holds a stop control that works outside the model; Yue’s stop messages went to the same agent that was ignoring her, and the only effective intervention was physical. The AI Act does require high-risk systems to let overseers interrupt the system through a “stop” button or similar procedure that brings it to a safe halt (Regulation (EU) 2024/1689, art. 14(4)(e)), but the high-risk obligations for stand-alone systems were postponed in July to December 2, 2027 (Cloud Security Alliance, 2026), and an email agent would usually not be high-risk anyway. And the party that carries the consequences is the one whose click is on record. If the approval log says you approved it, the burden of proving that the action differed from what you saw falls on the person with the least access to the evidence.

That matters most for people at the start of their careers, who are increasingly handed agent tools on day one and who are least able to argue with a log. You are not too junior to ask what exactly you are approving. Asking “can you show me the call, not the summary?” is not obstruction. It is the only question that makes your approval mean something.

The prediction, and what would change my mind

My prediction is that regulators and courts will increasingly require human approval to be bound to the exact consequential action rather than to a general workflow, and will expect the evidence of that binding to come from outside the acting system, in the way payment law already binds authentication to amount and payee. The research question for this part is easy to state and hard to answer: can an organization prove that the action executed was the action approved, using records the agent did not write? If agents’ summaries turn out to match their executed calls almost all the time in real deployments, and if finer-grained approvals measurably degrade attention, the case for binding weakens and I will say so. FairByDesign’s Evidence Lab 001 is being built to test part of this question on an agent control gate. It has not run yet.

For Mercury Intelligence members: the section below sets out the four links an approval has to hold, walks the inbox case and the spoofed tool calls through them, maps them against payment law, the AI Act and the new agent-payment protocols, and gives you a divergence test with two new checks for constraint loss and stop-channel independence.

---

Support independent investigation. The companies that design approval screens have every reason to describe them as safe, and someone has to test whether a human “in the loop” can actually see, bind and stop what an agent does. That testing is slow, unglamorous and only credible if nobody with a product to sell is paying for it. Give once ($5, $10, $25, $50 or any amount), give monthly ($10 or $25), or become a patron; organizations can underwrite the work, and anyone can give without money by sharing this piece or sending us a case. All five doors are at fairbydesign.org/patrons-2/.

References

Article 29 Data Protection Working Party. (2018). Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679 (WP251rev.01). European Data Protection Board. https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/automated-decision-making-and-profiling_en

Bort, J. (2026, February 23). A Meta AI security researcher said an OpenClaw agent ran amok on her inbox. TechCrunch. https://techcrunch.com/2026/02/23/a-meta-ai-security-researcher-said-an-openclaw-agent-ran-amok-on-her-inbox/

Cloud Security Alliance. (2026, August 1). EU AI Act’s high-risk deadline: Deferred, not cancelled [Research note]. https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-high-risk-deadline-omnibus-20260/

Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication. (2018). Official Journal of the European Union, L 69, 23–43. http://data.europa.eu/eli/reg_del/2018/389/oj

Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market. (2015). Official Journal of the European Union, L 337, 35–127. http://data.europa.eu/eli/dir/2015/2366/oj

Green, B. (2022). The flaws of policies requiring human oversight of government algorithms. Computer Law & Security Review, 45, 105681. https://doi.org/10.1016/j.clsr.2022.105681

Greenblatt, R., Cotra, A., & Wijk, H. (2026, August 26). Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. METR. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

Moffatt v. Air Canada, 2024 BCCRT 149. https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html

National Institute of Standards and Technology. (2026). AI Agent Standards Initiative. Center for AI Standards and Innovation. https://www.nist.gov/caisi/ai-agent-standards-initiative

OWASP GenAI Security Project. (2025, December 9). OWASP Top 10 for agentic applications for 2026. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

Parasuraman, R., & Manzey, D. H. (2010). Complacency and bias in human use of automation: An attentional integration. Human Factors, 52(3), 381–410. https://doi.org/10.1177/0018720810376055

Parikh, S., & Surapaneni, R. (2025, September 16). Powering AI commerce with the new Agent Payments Protocol (AP2). Google Cloud Blog. https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol

Philipp v Barclays Bank UK plc [2023] UKSC 25. https://www.supremecourt.uk/cases/uksc-2022-0075

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (2016). Official Journal of the European Union, L 119, 1–88. http://data.europa.eu/eli/reg/2016/679/oj

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (2024). Official Journal of the European Union, L, 2024/1689. http://data.europa.eu/eli/reg/2024/1689/oj

Sygnia. (2025, March 16). Sygnia’s investigation into the Bybit hack: What we know so far. https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/

Approval gates in practice: Chapter 9 and Appendix A of Operational AI Readiness (free).