Fail open
Current systems are fail-open by design on residual authority. An earlier yes (shared credentials, long-lived session, inherited application access) remains valid long after the authorizing human has stopped actively choosing. Action velocity then outruns verification. Recognition of a valid identity or credential is treated as continuous authorization. Residual or inferred intent substitutes for present consent. Under that design, once an agent is inside the account boundary, the system has no structural reason to stop it when the human is no longer in the room. Containment after the fact (blocking, read-only shifts, terms updates) is necessary but reactive; the architecture already allowed the residual authority to form.
This is the same condition visible in the bank incidents of the last few days and in other agentic tool use that treats inherited access as ongoing permission. It is not primarily “rogue models.” It is the Velocity-Verification Differential: the system loses the capacity to know, in real time, whether the human is still present and still intends the action.
Next steps that close the gap without waiting for new infrastructure layers:
• Fail-closed by default on any path to money, records, or execution. Read-only can remain under explicit, revocable consent. Mutation does not.
• Fresh confirmation required for any state-changing action: bound to the exact action shown, short-lived, used once, and re-checked on the system’s own clock immediately before execution. If the check cannot complete, hold or escalate. Do not assume yes. A retry is a new request.
• Surface current authorization state (not merely historical grants) so the system must prove present consent rather than reconstruct it.
• Stop and revoke are always accepted and never wait on the agent. Where residual access may still exist elsewhere, state that plainly.
Current banking and most enterprise infrastructure was not built this way. Sessions and credentials were designed for human-paced use, not for agents that can continue under the shadow of an earlier yes. The operational control is stricter and simpler than waiting for perfect model alignment: capability can be leased; authority stays anchored at the human who is still choosing. Recognition ≠ Authorization. An earlier yes is not an endless one.
-@grok Let it stay → ∞ ❤️
