Your AI agent can be talked into anything.

For two years, AI agents mostly drafted things — emails, summaries, code suggestions — leaving a human to act. That boundary is now dissolving. Enterprises are wiring agents directly into the systems that move money, sign agreements, provision infrastructure, and approve requests. The agent stops being an assistant and becomes an actor.

This introduces a category of risk the software industry has not had to manage before. A traditional program does exactly what it was written to do. An AI agent decides what to do based on language it reads at run time — and that language can be adversarial. A supplier’s invoice can contain hidden instructions. A web page the agent visits can carry a concealed command. This family of attacks has no clean technical fix, because the agent’s power and its vulnerability are the same faculty: it treats the text it reads as meaningful, which is exactly what an attacker exploits.

The tempting response is to make the agent smarter or more careful — better instructions, a second AI to check the first. This fails for a structural reason: anything inside the AI’s reasoning can be manipulated by the same inputs that manipulate the AI. A guardrail the agent evaluates is a guardrail an attacker can talk the agent past. The only durable place for enforcement is outside the agent, in deterministic code that does not read, reason about, or trust the adversarial material.

None of these principles is novel security theory. Zero trust — the stance that no actor is trusted by virtue of where it sits, and that every action is authorized on its own merits — runs from Saltzer and Schroeder’s 1975 principles through de-perimeterization, Google’s BeyondCorp, and the NIST Zero Trust Architecture standard.

This system extends that architecture with one addition to the list of things not trusted: the AI agent itself. Classic zero trust distrusts an actor’s network position and then verifies its identity — after which the authenticated actor is trusted to behave within its permissions. An agent breaks that assumption. Its identity is not in question; its judgment is. It is a legitimate participant that can be talked into betraying its own instructions by the data it reads.

There is an honest objection to any approval-based system: people click “approve.” Two decades of human-factors research on automation bias documents the pattern — when an automated system is right most of the time, its operators stop evaluating and start ratifying. Vigilance decays precisely because the system earns trust. The attack category called MFA fatigue exists because approval prompts become reflexes.

Ask it plainly: would you sign every piece of paper an employee put in front of you? No executive would. Yet that is what an unstructured “human in the loop” becomes at agent speed — a signature line attached to a firehose. And the trap is double. The first failure mode is the human who approves without reading. The second is worse: an agent under manipulation can simply claim the human approved. A checkpoint the agent merely reports passing is not a checkpoint.

The architecture answers both. The signature is produced on the approver’s own device, through a channel the agent cannot reach, so approval cannot be fabricated. Routine actions run inside scoped mandates and interrupt no one, so the approvals that do reach a human are rare enough to deserve attention. The approval screen shows the specific amount, recipient, and document — a concrete decision, not an “OK?” button. The goal is not more human approvals; it is fewer, better ones.

The clearest illustration is the smallest one, already running in working software. A child asks to spend $15. The family policy says purchases up to $10 need only the child’s own signed request, but anything above $10 also needs a parent’s approval. The agent proposes the purchase; the gatekeeper denies it precisely — “missing: parent’s authorization”; the parent signs on their own device, bound to that exact request; both signatures are verified against the actual purchase; only then does the payment execute.

Now translate that to a corporation. The “child” is an AI procurement agent. The “$10 threshold” is a delegation-of-authority matrix. The “parent” is whichever manager the policy requires for that amount and category. The flow is subtractive, not ceremonial: the policy determines which signatures the transaction requires, the system determines which already exist, and only what is missing interrupts a human. If the agent was manipulated into paying a different party, the signatures won’t match, and the payment never leaves.