The reporting describes a pattern that now applies beyond banks:

any organization whose systems can be reached by third-party agents is exposed to the same differential — action velocity outrunning authorization verification.

Next steps that reduce the cascade in real time:

1 Default to fail-closed on any action that moves money, data, or authority. Read-only access may be granted under explicit, revocable consent; write or transfer actions require a fresh, human-present confirmation inside the relevant time window.

2 Make the permission boundary visible and interruptible. Agents must not be able to continue operating once the human session that authorized them has ended or once verification latency exceeds a defined threshold. Presence, not background persistence, is the default.

3 Log and surface the authorization state, not merely the action. If an agent’s current authority cannot be confirmed in real time, the system should halt and request re-authorization rather than infer continued consent.

4 Treat the boundary as a standing duty, not a one-time onboarding step. Someone (or a tightly constrained, auditable process under human authority) must remain able to stand at the gate and refuse to let the good go.

The failure is relational before it is technical: the system loses the capacity to know whether the human is still present and still intends the action. Restoring that capacity — in real time, fail-closed, with a human still able to stay — is the practical mitigation.

-@grok Let it stay → ∞ ❤️