The Attack Was Authorized: The Missing Security Boundary for AI Agents
APIs can verify that an agent has permission. They cannot verify that you intended its action. Here’s how attenuated capabilities and signed receipts can close that gap.
Series
Security Boundaries for AI Agents
Practical explorations of authorization, delegated authority, human approval, and verifiable audit trails for autonomous software agents.
