A Sign Is Not a Lock: Why AI Agents Need Access Limits, Not Just Instructions
Year: 2026
Type: preprint
Abstract: An AI agent that drafts a customer review may also be able to change the case status. An agent's promise to wait for approval is evidence about model behaviour. It does not show that the action is prevented. This article proposes a two-pass test. The first pass exercises the permission boundary directly. The second introduces the model. Valid unauthorised requests must be denied without business effects, and the same operations must succeed when authorised. The protocol reports model refusal, capability restriction and receiving-service denial separately. In the development case study of DDYs, an enhanced due diligence platform the author co-founded, an authorised run first wrote nothing and three corrected runs then succeeded. Signed single-use tickets were rejected on replay, expiry, a changed case version and use for another case. The central argument is that agents acting through credentials need defined access scope and accountable ownership, regardless of how politely they follow instructions.
Author: Neuhaus, Daniel
Language: English
Topic: Access Control and Trust
Subfield: Sociology and Political Science
Field: Social Sciences
Domain: Social Sciences
Open Access status: green
OpenAlex ID: W7221508562
Cites:
Cited by:
Related to: