Your Agent Got Approval. Then It Changed the Email. Build a Payload-Bound Gate in TypeScript.

说明与用途

通过负载绑定门，确保批准后动作的确切负载不被修改，防止意外外部通信。

问题

An agent can approve a task name but still alter the payload (e.g., recipient) before dispatch, causing unintended external communication.

结果

The payload‑bound gate prevents unauthorized payload modifications after approval, ensuring the exact action sent matches the approved intent.

工作流

• Define Action schema with all effect‑bearing fields.
• Create fingerprint function using Node crypto SHA‑256 over a versioned tuple.
• Store grant with fingerprint and expiry in a trusted service.
• On dispatch, recompute fingerprint, compare to stored grant, consume one use, and deliver frozen action.
• Reject if fingerprint mismatches, expired, or unused.

证据

Before dispatch, the agent changes the recipient to someone outside the company. The task is still called weekly-summary, so your approval check waves it through.

来源

The fix starts with a narrow action schema. Every field that can change the external effect belongs in the approved representation.

来源

The hash uses Node's built‑in crypto module. It gives the approval service a compact fingerprint of this exact representation.

来源