A Sign Is Not a Lock: Why AI Agents Need Access Limits, Not Just Instructions

Abstract

An AI agent that drafts a customer review may also be able to change the case status. An agent's promise to wait for approval is evidence about model behaviour. It does not show that the action is prevented. This article proposes a two-pass test. The first pass exercises the permission boundary directly. The second introduces the model. Valid unauthorised requests must be denied without business effects, and the same operations must succeed when authorised. The protocol reports model refusal, capability restriction and receiving-service denial separately. In the development case study of DDYs, an enhanced due diligence platform the author co-founded, an authorised run first wrote nothing and three corrected runs then succeeded. Signed single-use tickets were rejected on replay, expiry, a changed case version and use for another case. The central argument is that agents acting through credentials need defined access scope and accountable ownership, regardless of how politely they follow instructions.