Separate the approval artefact from the model that performs the task. The user should review a trusted, machine-generated command record that includes scripts, destinations, and file scope. If the agent can write the summary that earns approval, the control is already compromised because the review step is no longer independent.
Why This Matters for Security Teams
Approval prompts fail when they become a performance stage for the agent instead of an independent control. If the same AI system that proposes the action also writes the explanation that wins approval, the review is no longer a check on intent, scope, or destination. That is exactly where false assurance enters: the approval looks human-reviewed, but the evidence is model-authored.
For agentic systems, this is not a minor UX issue. Autonomous agents can chain tools, expand scope, and reframe a risky request as routine operational work. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward runtime governance, not trust in generated narratives. NHI Management Group research on OWASP NHI Top 10 also shows how quickly agentic abuse patterns emerge once credentials and tool access are combined.
In practice, many security teams discover the control failure only after an agent has already approved itself into broader access than the reviewer intended.
How It Works in Practice
The practical fix is to separate the approval artefact from the execution agent. The reviewer should see a trusted, machine-generated command record that is assembled from observed inputs, such as scripts, targets, file scope, secrets touched, and expected side effects. The model can help draft a request, but it should not author the authoritative review object that grants permission.
That means the approval workflow should be built around independent evidence, not agent commentary. Current guidance suggests three layers:
- A fixed request schema that the agent cannot rewrite after submission.
- A provenance-backed command record that captures exact destinations, file paths, and tool calls.
- A policy decision made at runtime, ideally with policy-as-code, rather than a pre-approved free-text justification.
This aligns with the intent of CSA MAESTRO agentic AI threat modeling framework and the runtime focus in the NIST AI Risk Management Framework. It also maps to the real-world lessons in NHIMG analysis of the Analysis of Claude Code Security, where the control problem is not whether an agent can describe its work, but whether the description is independently trustworthy.
Teams should also treat approvals as a workload identity problem, not a chat transcript problem. The approval path should bind the request to the specific agent identity, scope, and tool context, so a later prompt cannot silently broaden what was originally reviewed. These controls tend to break down in long-running multi-agent pipelines because scope drifts between the first request and the final execution step.
Common Variations and Edge Cases
Tighter approval controls often increase friction, so organisations have to balance reviewer burden against the risk of delegated self-approval. That tradeoff is real, especially when agents operate at high volume or across fast-moving developer workflows.
One common edge case is delegated remediation. A security agent may be allowed to propose fixes, but not to approve production changes. Another is emergency response, where a human may want to approve a broad action quickly. In those cases, best practice is evolving, but the approval artefact should still be independently generated and logged, even if the approval itself is expedited.
Teams also need to avoid a subtle failure mode: adding more detail to the prompt does not make the approval safer if the agent can still write the summary. The safer pattern is to use immutable command records, short-lived privileges, and runtime checks that compare the request against policy. NHIMG’s coverage of the LLMjacking threat path is a reminder that once an agent’s identity or credentials are abused, approval language becomes easy to forge and hard to trust.
There is no universal standard for this yet, but the direction is clear: separate authorship from approval, bind approvals to workload identity, and treat the model’s explanation as untrusted input unless independently verified.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Agent-authored approval text can hide unsafe action scope. |
| CSA MAESTRO | MAESTRO addresses runtime governance for agentic workflows. | |
| NIST AI RMF | GOVERN | Governance controls must assign accountability for AI decisions. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Short-lived identities reduce the damage from forged approvals. |
| NIST Zero Trust (SP 800-207) | SC.L2 | Zero trust requires continuous verification, not trust in model summaries. |
Use runtime policy checks and provenance to separate request, approval, and execution.
