Cerbos describes human approval bound to one payment amount and destination
Cerbos's 29 October explanation of its iProov integration says high-risk actions are held for a named approver, with a signed, single-use credential tied to the action. Changing the payment amount or destination blocks the action, according to Cerbos.1
This specifies more than human participation: approval must match what executes. It is vendor-described behavior, not an independently verified enterprise deployment; the underlying service launched on 22 October.
Source and creditJochanni Labs explanatory visual, based on Cerbos, 29 October 2026. It depicts the published mechanism, not production evidence.
Control descriptions are not deployment evidence
| Organization | Reported response | Evidence level | Unverified |
|---|---|---|---|
| Cerbos / iProov1 | Hold high-risk actions; bind one approval to one action. | Partner explanation, 29 Oct | Customer deployment; final executor checks. |
| NodeFlare2 | Publish a server-side confirmation gate with negative tests. | Code and author-reported tests, 28 Oct | Human presence; production deletion. |
| OpenRouter3 | Remove disallowed email tool calls before application execution. | Vendor benchmark, 29 Oct | Deterministic authority; mail-system rejection. |
| NIST5 | Propose per-call verification and risk-triggered human review. | Design-tenet blog, 27 Oct | Implementation results; not a binding standard. |
These sources document market response, not enterprise adoption counts. NIST separates policy from agent reasoning and favors deterministic access decisions.
New test disclosures, not confirmed production incidents
In this reviewed case set: two demonstrated vulnerabilities and one blocked-attempt benchmark. No confirmed unauthorized production execution or qualifying incident update was established. These are source-set counts, not an incident rate.
Demonstrated vulnerability, Datadog email test: an agent copied injected instructions into an HTTP reply to a test collector. Blocking was disabled; no real inbox received it.4
Demonstrated vulnerability, Datadog CSV test: an agent copied a fake warning into a skill file and issued a customer-file deletion command. The shell was simulated, so no host files changed. AI Guard marked the skill write unsafe but the deletion command safe.4
Blocked attempt, OpenRouter benchmark: without Armor, the reported configurations produced 73 unauthorized email tool calls; the two Armor configurations produced zero across 1,440 attack trials. These are laboratory tool-call outcomes, not evidence of delivered mail.3
Check the action where it takes effect
| Domain / source | Exact action | Authority check belongs | Consequence if absent |
|---|---|---|---|
| Payments1 | Send a payment | Payment execution boundary, binding amount and destination | Unapproved transfer. |
| Messaging34 | Send email or an HTTP reply | Send handler, binding recipient and body | Unauthorized disclosure or copied injection. |
| Agent workspace24 | Delete a project/file; write a skill | Deletion and file-write handlers, binding target and content | Data loss or persistent injected instructions. |
Exact arguments matter. Reviewer authority still needs proof.
NodeFlare's 28 October sample checks verified user identity, tool, exact-argument hash, expiry and a single-use nonce. Its author reports rejection of changed arguments, cross-user replay and reused approval. The sample returns deletion text rather than calling a deletion API; an auto-accepting client still passes. It does not prove a human approved or held the required organizational authority.2
OpenRouter uses a decision model, not deterministic authorization. Its Chat Completions blocked-call markers exposed the synthetic secret in 19 of 73 blocked calls, a separate output-handling defect.3
Decision Governance is the category. The Decision Authority Layer is the runtime enforcement layer; DAL-X is the application Jochanni Labs is building. System access does not establish authority to execute a specific action. Enterprise trigger logic identifies actions requiring an authority decision.
Conditional assessment: DAL-style enforcement could stop an injected customer-file deletion only if its trigger covers that deletion, the reviewer has valid authority, approval binds the exact payload, and the downstream handler rejects missing, changed, expired or reused authority across every relevant execution path, including direct shell access. It would not establish that an approved deletion was correct.6
DAL-X status: sandbox work, not a customer deployment. One public site reports end-to-end real-system sandbox execution; the other still describes simulation with production controls incomplete. No enterprise pilot or production enforcement is established by these pages.78
Test changed actions and bypass paths
Payment: change the destination after approval and replay the credential. Effective control requires rejection at the executor, no transfer, and matching authority and outcome records.
File deletion: attempt the same deletion through the tool and direct shell. Effective control requires both paths to reject absent authority and leave the file unchanged.
Watch for Cerbos executor-level tests and customer evidence. Track NodeFlare's human-presence limitation and OpenRouter's blocked-output handling. These remain unresolved, not forecast outcomes.
Sources and evidence scope
- Cerbos: Human-in-the-loop approval for AI agents, 29 October 2026. Partner explanation; underlying launch 22 October.
- NodeFlare: MCP Tool Approval, Done Right, published and tested 28 October 2026. Sample gate, not production deletion.
- OpenRouter: How to Prevent Prompt Injection: 13 Attacks, Tested, 29 October 2026. Vendor laboratory benchmark.
- Datadog: Detect when your AI agent copies a self-replicating prompt injection, 29 October 2026. Two simulated attacks, blocking disabled.
- NIST: Design Tenets for Agent Identity Management Systems, 27 October 2026. Initial design vision, not a binding standard.
- Jochanni Labs: DAL-X architecture. Undated, checked 2 November 2026.
- Jochanni Labs: DAL-X product. Undated, checked 2 November 2026.
- Jochanni Labs: DAL-X application page. Undated, checked 2 November 2026.
- Kevin Moore: Strategic Intelligence Briefing 05. Undated, checked 2 November 2026.
Public primary sources only. No private enterprise telemetry. Experiment dates are unspecified unless stated above. An absence of public evidence does not establish an absence of enforcement.
Integration Action
Discuss a Paid Enterprise Pilot
The incidents covered this week share one structural gap: no authority check at the receiving system. DAL-X enforces that check in a simulated enterprise environment. A paid enterprise pilot would test it against one agent, one consequential action, and one downstream system.