Why do approval workflows fail to stop prompt injection in agentic systems?

Why This Matters for Security Teams

Approval workflows are often treated as a safety barrier, but in agentic systems they are usually only a human checkpoint on top of an already influenced decision. Prompt injection can steer the agent toward a convincing request that looks legitimate on its face, even when the hidden instruction came from a malicious source. That makes the control weaker than many teams expect, especially when the agent can write, send, or change state.

The core problem is visibility. A reviewer can assess the proposed action, but not necessarily the chain of instructions, retrieved content, tool outputs, or memory state that shaped it. Guidance from the NIST AI Risk Management Framework is useful here because it pushes teams toward govern, map, and measure activities rather than relying on a single approval gate. The same lesson appears in the OWASP Agentic AI Top 10, where tool misuse, instruction hierarchy failure, and unsafe autonomy are treated as distinct risks.

In practice, many security teams only discover the weakness after an apparently approved action has already exfiltrated data, changed access, or triggered an unintended workflow.

How It Works in Practice

Approval workflows work best when the action itself is the risk, but prompt injection changes the threat model. The agent may be following a malicious instruction embedded in a document, ticket, email, webpage, or tool response long before the approval step appears. By the time a human reviews the request, the output often looks like a normal business task, so the reviewer approves the symptom rather than the cause.

That is why approval should be treated as one layer in a broader control set, not as the primary defense. Effective programs usually combine request approval with runtime controls that can inspect prompts, constrain tool access, and monitor behavior across the full execution path. The MITRE ATLAS adversarial AI threat matrix is helpful for mapping attack patterns such as indirect prompt injection, tool abuse, and model manipulation. The CSA MAESTRO agentic AI threat modeling framework also reflects the need to design controls around the whole agent loop, not just the last human decision.

• Validate the source and trust level of inputs before they reach the agent.
• Restrict tools by task, data type, and privilege scope.
• Log prompt, retrieval, and tool-call context so reviewers can see what influenced the action.
• Use policy checks at runtime to block unsafe writes, not just post hoc approvals.
• Compare proposed behavior against expected baselines for the agent and the workflow.

For higher-risk deployments, security teams should also define which actions require human approval, which require dual control, and which should be blocked entirely when the agent cannot prove provenance. These controls tend to break down when the agent has broad tool access, untrusted retrieval sources, and no reliable separation between user instructions and external content because the approval layer receives a sanitized request with no visible evidence of coercion.

Common Variations and Edge Cases

Tighter approval gates often increase latency and reviewer burden, requiring organisations to balance operational speed against better control over agentic writes. That tradeoff is especially visible in customer support, finance, and DevOps workflows where the agent must act quickly and the business wants minimal friction.

There is no universal standard for this yet, but current guidance suggests that approval should be adaptive. Low-risk actions may only need logging and anomaly detection, while high-risk writes, privilege changes, or external communications should require stronger authorization and runtime inspection. The question is not whether a human approves the action, but whether the system can explain why that action is being proposed and whether the agent’s context has been poisoned.

Teams should be careful with memory, retrieval-augmented generation, and shared toolchains. A benign approval step can still sit downstream of a compromised knowledge source or an injected document that quietly changes the agent’s behavior. This is one reason the OWASP guidance on agentic applications and the NIST AI Risk Management Framework both favor layered governance rather than single-point review. In practice, the hardest cases are systems that blend open-ended retrieval, persistent memory, and write privileges, because the approval prompt looks safe even when the reasoning chain has already been captured.

Related resources from NHI Mgmt Group

• Why do static guardrails fail against prompt injection in agentic systems?
• What is the difference between prompt injection and tool poisoning in agentic systems?
• Why do agentic workflows need a protocol for human approval instead of a simple prompt?
• How should security teams contain prompt injection in agentic systems?