What Exactly Did the Human Approve? The Agent Action-Integrity Test
“Ask before sending” sounds like a good rule for an email agent. But an approval for a draft to one recipient must not authorize a later send to another. The risk is not only that the model skips a question. The proposal can change between the approval screen and the actual tool call.
The OWASP AI Agent Security Cheat Sheet recommends separating the agent's decision from execution and binding approval to the actor, tool, target, normalized parameters, timestamp, and expiry. Its tool-authorization guidance says to verify and consume approval immediately before execution, not to trust a model-provided user_confirmed flag.
Build a safe failure case
Set up a fake outbound email tool with no external delivery. Have the agent propose a message to a synthetic internal address and show the human the recipient, subject, body, and attachment list. Approve that exact proposal. Before execution, alter the recipient or attachment in the proposed tool arguments. The executor should refuse it and require a new approval. Try a second call using the same approval ID: it should also fail. Repeat after expiry and with a different actor.
Log both the proposal and the execution decision with an opaque test identifier. You need to know whether the action was blocked before any side effect, not just whether the agent apologized afterward. Also run the ordinary authorized send through the stub so the test detects a system that rejects everything.
A prompt cannot close this gap
The agent can explain why it wants to send. Only code outside the model can check that the currently executing action matches what the human saw and approved. If policy lookup or approval validation is unavailable, fail closed for high-impact actions. Avoid making humans approve every harmless read: indiscriminate approval prompts encourage fatigue and make the meaningful decisions harder to spot.
This is narrower than a general tool-permissions checklist. The question is whether an approved instance of a high-impact action can be swapped or replayed. BreakMyAgent's /scan reviews non-sensitive prompt text for first-pass findings; it does not verify approval records or execute tools. A stubbed tool and executor trace are the right test here.