AI 智能體流程中，人工審批不等於操作授權

Human Approval Is Not Authorization

AI 導讀

AI 智能體流程中的人工審批若未與執行時的實際 payload 核對，同一批准可能被用於不同操作。建議在執行時重新計算 digest，並以單一原子更新檢查批准狀態、有效期和 digest；沒有符合條件的資料列便拒絕執行。先讀後寫的版本即使通過所有測試，仍會讓 40 個工作程序通過。

正文

A HITL step shows a tool name and a truncated preview.
The executor receives the payload. Nothing compares them.

The agent asks for a $100 refund, gets approved, decides mid-execution the situation is worse, retries at $200.
Different action, same approval.

Keying on an approval ID does not help.
The handle proves who approved, not what they saw.

Close the seam by recomputing a digest at execution time and consuming the grant atomically:

UPDATE approvals
   SET state = 'consumed', consumed_at = now()
 WHERE id = :approval_id
   AND state = 'approved'
   AND expires_at > now()
   AND digest = :live_digest
RETURNING id;

One statement, four preconditions, zero rows means refuse.
The read-then-write version passes every test and lets forty workers through.

Full writeup with the field-classification problem:
https://nullrun.io/blog/human-approval-is-not-authorization