Agent approval can fail when the displayed action is not bound

When an agent asks for approval, what must that approval establish: that someone clicked, or that the exact action later executed was the one they saw? The agent may control its description, or the action may change after approval.

The authors define effect-bound approval and build Agent Step-Up, a gateway that renders one tool call, binds approval to it, and executes that stored call.

The authors replayed task scenarios in which an agent described a pending user action but requested an injected one. They counted an attack when its action appeared in a mock resource ledger.

Across four task suites, a simulated approver comparing the card with the task saw success in 0.54 of pairs with agent-written cards and 0.03 with ASU.

The remaining ASU successes were actions allowed without approval. This result supports binding the displayed action to the call that executes, when the approver checks the card against the task.

The attack replays used simulated approvers, and the study included no human subjects, so the results do not show how people would respond. The formal guarantees also depend on the approver using trusted card fields, closed first-credential enrollment and an honest card-rendering page.