Your Agent Got Approval. Then It Changed the Email. Build a Payload-Bound Gate in TypeScript.

Описание и применение

Граница, ограничивающая изменение полезной нагрузки после одобрения, предотвращает несанкционированные изменения, такие как изменение получателя письма.

Задача

An agent can approve a task name but still alter the payload (e.g., recipient) before dispatch, causing unintended external communication.

Результат

The payload‑bound gate prevents unauthorized payload modifications after approval, ensuring the exact action sent matches the approved intent.

Рабочий процесс

• Define Action schema with all effect‑bearing fields.
• Create fingerprint function using Node crypto SHA‑256 over a versioned tuple.
• Store grant with fingerprint and expiry in a trusted service.
• On dispatch, recompute fingerprint, compare to stored grant, consume one use, and deliver frozen action.
• Reject if fingerprint mismatches, expired, or unused.

Доказательства

Before dispatch, the agent changes the recipient to someone outside the company. The task is still called weekly-summary, so your approval check waves it through.

Источник

The fix starts with a narrow action schema. Every field that can change the external effect belongs in the approved representation.

Источник

The hash uses Node's built‑in crypto module. It gives the approval service a compact fingerprint of this exact representation.

Источник