Your Agent Got Approval. Then It Changed the Email. Build a Payload-Bound Gate in TypeScript.

Description and use

A payload‑bound gate ensures that after approval, the exact action payload cannot be altered, preventing unintended external communication.

Problem

An agent can approve a task name but still alter the payload (e.g., recipient) before dispatch, causing unintended external communication.

Outcome

The payload‑bound gate prevents unauthorized payload modifications after approval, ensuring the exact action sent matches the approved intent.

Workflow

• Define Action schema with all effect‑bearing fields.
• Create fingerprint function using Node crypto SHA‑256 over a versioned tuple.
• Store grant with fingerprint and expiry in a trusted service.
• On dispatch, recompute fingerprint, compare to stored grant, consume one use, and deliver frozen action.
• Reject if fingerprint mismatches, expired, or unused.

Evidence

Before dispatch, the agent changes the recipient to someone outside the company. The task is still called weekly-summary, so your approval check waves it through.

Source

The fix starts with a narrow action schema. Every field that can change the external effect belongs in the approved representation.

Source

The hash uses Node's built‑in crypto module. It gives the approval service a compact fingerprint of this exact representation.

Source