Four Failure Modes, Two Fixes, and a Loop: Hebrew Name Matching in an Agent Authorization Gate
Year: 2026
Type: preprint
Abstract: A production authorization gate for an AI agent system asks one question before any action that touches a person: did the manager name this person in the instruction? When the instruction text is Hebrew, the naive implementation — a substring check — fails open: prefix letters glue onto words, so short names are swallowed inside ordinary vocabulary, and actions execute on people the manager never mentioned. The standard fix, a regex word boundary, fails in the opposite direction: \b never matches Hebrew in engines where \w is ASCII, so every action escalates. This article walks through four failure modes and sorts them by direction (fail-open vs. fail-closed), measures the name/noun collision on a pre-registered list of 89 Israeli given names (44.9% are also common nouns), shows why a spellchecker is the wrong oracle in a script without capitalization, and reports a production finding: in a gate that logs only escalations, false positives are not merely unmeasured — they are unrecordable. Over-escalation is not a safe default either: it supplies the precondition of approval-fatigue attacks (MITRE ATT&CK T1621) for free. The conclusion is structural: anchor person-actions to entity identifiers chosen upstream, and log every gate decision, not only the escalations. Hebrew and English versions of the article are included. Discussion and corrections: https://github.com/ariel-levy-il/four-failure-modes/issues
Author: Levy, Ariel
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7203714167
Cites:
Cited by:
Related to: