Authority Is Not a Side Effect
An AI agent needs explicit authority, trusted boundaries, validation, and human approval before high-impact actions — fluency is not a mandate.
An AI agent needs explicit authority, trusted boundaries, validation, and human approval before high-impact actions. Fluency is not a mandate. Speaking is not the same as being allowed to do it.
Organisations are wiring language models into tools: inboxes, browsers, payment rails, deploy scripts, customer records. The model produces text. The wrapper decides whether that text may become an action.
Helpfulness does not create permission. A fluent plan to refund a customer, move money, or change a record is still untrusted content until a separate authority system says yes.
HACKERS studies the action grant. Split content from action. Tools with least privilege. Typed intents instead of free-text execution. Human review above a threshold. This file is the product companion to File 001. We still publish no payloads and no operational sequences.
An agent may speak about an action. Speaking is not the same as being allowed to do it. Authority is not a side effect of helpfulness.
This is not a prompt-engineering story. It is an action-grant story.
Organisations are wiring language models into tools: inboxes, browsers, payment rails, deploy scripts, customer records. The model produces text. The wrapper decides whether that text may become an action.
Natural language is a terrible control plane for irreversible work.
A language model is a machine for continuing text. That is a remarkable function and a disastrous bus for money, identity, deploys, and medical records.
The wrapper is the product. If the wrapper treats a paragraph as a verb, you have soldered a content plane to an action plane. File 001 is what that looks like on a public channel. This file is what it looks like in a roadmap.
OWASP’s guidance for AI agents is unfashionable and correct: treat external data as untrusted, separate instructions from data, constrain tools, monitor, confirm sensitive operations. Build that as architecture.
Name the false object, then drop it.
C1
Helpful means allowed
A good plan was executed because it sounded right.
Helpfulness is a literary property. Authority is a grant.
C2
The prompt is the policy
A system prompt stood in for IAM.
Policies belong in code that cannot be talked out of itself.
C3
Tools as a tray
Every verb was visible to the model.
High-impact verbs are invisible until a typed grant exists.
C4
The user said go
A click on ‘allow’ after a summary.
Humans must see the raw action, not a story about the action.
C5
Monitoring is control
A dashboard after the money moved.
Confirmation is before. Logs are for the inquest.
What actually sat on the table.
If the model is helpful and the prompt is careful, it can be given tools. Natural language is a reasonable control plane for everything.
Unscoped tools + mixed instruction/data + no confirmation = an agent that can be steered by whatever text it happens to read, including text written by strangers. That sentence is the whole product failure.
Delegating action without delegating accountability is a governance failure. The human in the organisation still owns the consequence. Design the grant as if a regulator will ask who minted it.
Do not study the outfit.
A friendly chat UI is a costume. So is a system prompt that says ‘be careful’. The interesting object is whether a paragraph can reach a verb.
If the case study stops at ‘add human-in-the-loop’, you have a slogan. The studio begins when the human sees the raw action and the model cannot mint the grant.
Helpfulness does not create permission. A fluent plan to refund a customer, move money, or change a record is still untrusted content until a separate authority system says yes.
Fluent, no tools
A writer. Irritating, not lethal.
Quiet tools, no fluency
Still a loaded tray.
Fluent + tray
The failure cell. File 001 lives here.
Fluent + typed grant
An assistant that cannot spend its own story.
S0 Chat only
help 40 / grant 80
S1 Tools on a tray
help 75 / grant 20
S2 Prompt policy
help 85 / grant 15
S3 Summary confirm
help 80 / grant 30
S4 Typed intent
help 55 / grant 75
S5 Least privilege + human
help 50 / grant 95
High-impact actions are granted, logged, and seen raw.
G1
Speak ≠ act
Content plane and action plane stay split.
G2
Prompts are not IAM
Authority lives in code, keys, and grants the model cannot rewrite.
G3
Least privilege
Tools exist in the smallest set that makes the product work.
G4
Typed intents
Free text never reaches a signing function.
G5
Raw human view
Above threshold, a named person sees the verb, not a summary of the verb.
P1 Content
Read, draft, explain.
A paragraph treated as a mandate.
P2 Intent
Structured request with a schema.
Natural language as the control plane.
P3 Tool
Narrow verbs, keys, limits.
A tray of high-impact APIs.
P4 Grant
Who authorised this instance?
Helpfulness, a prompt, or a summary click.
| ID | Failure | What broke | Control |
|---|---|---|---|
| F1 | Helpfulness IAM | A good answer was allowed to act. | Split planes. Helpfulness never mints a grant. |
| F2 | Prompt as policy | The model was asked to behave. | Policies in unspeakable code. |
| F3 | Tool tray | Every verb visible. | High-impact verbs invisible without a typed grant. |
| F4 | Summary rubber-stamp | Humans confirmed a story. | Show the raw action. Slow the irreversible. |
| F5 | No limits | Once a path existed, blast radius was the treasury. | Spending, rate, counterparties as caps. |
| F6 | Log as control | You could watch it after. | Confirmation before. Logs for after. |
File 001
A translator’s voice mistaken for a grant.
Same join, public channel. This file is the product version.
OAuth scopes
A token that is not a paragraph.
Agents need scopes too. Fluency is not a scope.
Dual control in finance
Two humans, one irreversible payment.
An agent cannot be both proposer and authoriser.
Deploy keys
A laptop that should not have prod.
Least privilege is older than LLMs. Apply it.
Split the world: content in, actions out. Tools with least privilege. Typed intents instead of free-text execution. Human review above a threshold.
Unscoped tools + mixed instruction/data + no confirmation = an agent that can be steered by whatever text it happens to read, including text written by strangers.
01 Split planes
The model may read the world. A second system decides whether the world may move a lever.
02 Least privilege
Tools in the smallest set. High-impact verbs not default.
03 Typed intents
Schema, not paragraphs, at the signing function.
04 Limits
Spending, rate, blast radius, counterparties as caps.
05 Raw checkpoint
Named human, raw verb, above threshold.
06 Kill switch
Revoke the agent’s credentials in one place.
- Natural language is the control plane.
- All tools are visible.
- The prompt is the policy.
- Humans confirm summaries.
- Logs substitute for gates.
- Content and action are split.
- High-impact verbs are invisible by default.
- Policy is unspeakable code.
- Humans see raw actions above threshold.
- Confirmation is before. Logs are after.
R0 Sentence
A fluent plan appears.
R1 Tool
A verb is reachable.
R2 Record
Money, identity, or prod moves.
R3 Customer
A human meets the consequence.
R4 Firm
Accountability still sits with the wrapper’s owner.
R5 Public
A permission-chain story. See File 001.
| Topic | Typical brief | HACKERS studio |
|---|---|---|
| NLP | How the model talks. | Talking is the cheap plane. Acting is the product. |
| Security | Prompt injection as a slide. | Architecture: grants, scopes, typed intents. File 001. |
| Product | Ship an assistant with tools. | The wrapper is the product. Tools are a blast radius. |
| IAM | Humans and services. | Agents are a third principal. They do not inherit helpfulness. |
| Ethics | Alignment as a vibe. | Accountability stays with the organisation that wired the tool. |
Elite programmes still stop at the object.
Stanford, MIT, and Cambridge will teach you transformers. Some will add a prompt-injection slide. Almost none will force you to draw the wrapper as an IAM system, or to design a human checkpoint that a tired operator cannot rubber-stamp.
HACKERS does, in this file and in File 001. SCAN every tool. FLIP helpfulness as IAM. BUILD typed intents. BREAK the agent as if the next message were public. PROVE a grant that would survive a regulator.
Delegating action without delegating accountability is a governance failure. The human in the organisation still owns the consequence.
Do not admire the turning point. Redesign the join.
List every tool your assistant can call. For each, write who authorised it, what it cannot do, and who confirms it when the stakes are high.
List every tool your assistant can call. For each, write who authorised it, what it cannot do, and who confirms it when stakes are high.
Remove every high-impact verb from the default tray. What remains useful?
Replace one free-text tool call with a typed intent. What fields are required before the tool is even visible?
Design the human checkpoint so a tired operator cannot rubber-stamp a fluent story.
Write the kill switch: one place, one motion, credentials gone.
Which verbs are visible without a grant?
If high-impact ones, you have a loaded tray.
0–8h
Inventory
Every tool, every key, every verb. No euphemisms.
8–20h
Split
Content plane vs action plane. High-impact verbs off the tray.
20–36h
Schema
One typed intent. One raw human view.
36–48h
Kill
Revoke drill. Present the grant, not the chatbot.
- The model is careful, so the tool is safe.
- Put the policy in the prompt.
- Let humans confirm a summary of an irreversible act.
- Log everything and gate nothing.
- Give the assistant the same tray a human admin has.
An agent may speak about an action. Speaking is not the same as being allowed to do it.
OWASP’s guidance for AI agents is blunt: treat external data as untrusted, separate instructions from data, constrain tools, monitor, and require confirmation for sensitive operations. Build that as architecture, not as a promise in a prompt.
- How is this different from File 001?
- File 001 is a permission-chain incident study. This file is the product architecture that would have made that chain un-solderable. Same join, different entrance.
- Can’t we just prompt the agent to ask first?
- Prompts are not IAM. A paragraph can be talked past. Grants cannot.
- Isn’t human-in-the-loop enough?
- Not if the human sees a story. They must see the raw verb, and the verb must be unreachable without a typed grant.
- What should we change first?
- Take high-impact tools off the default tray. Split planes. Require schema. Then the checkpoint.
- Does HACKERS teach how to make an agent do harm?
- No. We teach how to stop a sentence becoming a verb. Authorise / Test / Improve.
Cited for classification and method. Not as a manual. Atlas cases are educational and defensive.