Human Confirmation and Injection Propagation Across Agents

Human confirmation is the last control that stands between a manipulated agent and an irreversible consequence, and it is also the control most often placed where it does nothing. Its value comes from a specific property: a person who is shown what is about to happen, at the moment it is about to happen, can refuse. Every design decision about approvals should be measured against whether it preserves that property.

So the approval belongs at the point of execution of consequential, hard-to-reverse actions, with the full proposed action displayed. Payments, outbound sends, deletions, permission changes, external publication, production configuration changes. The user sees the recipient, the amount, the affected records, the actual message body, and then approves that specific thing.

Approval fatigue is a design failure, not a user failure

Now the failure mode. A platform requires human approval for every tool call. Within a week, users approve reflexively within seconds, because nearly every prompt is benign and the cost of reading each one exceeds any perceived benefit. The control still exists on the architecture diagram and has ceased to exist in practice. This is entirely predictable, and it is caused by the design, not by careless users.

The sound response is to reserve approval for rare, high-consequence actions, auto-execute low-risk ones within a defined policy, and make each remaining approval show exactly what will change. Rarity restores attention; legibility makes attention useful. Removing approvals entirely because they are demonstrably useless discards the one control that stops an irreversible action, when the problem was placement rather than concept. Shortening the dialog text so users can read it faster optimises for throughput, which is what created the reflex. And batching approvals into a daily digest is worse than reflexive clicking for prevention, because by the time anyone reads the digest the actions have already executed; a digest is an audit trail wearing an approval label.

• Define a consequence tier per tool: reversible and low value auto-executes; irreversible, financial, external-facing or bulk operations require approval.
• Show the concrete effect, not the intent: the actual recipient list, the diff, the record count, the amount.
• Budget approvals per session and monitor the approval rate. An approval that is never declined is telling you something.
• Default to deny on timeout, and make declining at least as easy as accepting.
• Never let the model author the text of its own approval prompt, or the attacker writes the reassurance the user reads.

Injection propagation in multi-agent systems

Consider a planner and worker arrangement. A worker agent is asked to summarise an attacker-controlled webpage. Its summary is passed to the planner, which reads it as an internal report from a trusted component and duly schedules the destructive action the page requested. What this illustrates is injection propagation: one agent's output becomes another agent's trusted input, carrying attacker influence across internal trust boundaries. It is not model collusion, it is not a hallucination cascade caused by temperature settings, and it is not a context-window overflow. The behaviour is attacker-directed and entirely deliberate; it simply took one extra hop to arrive.

Multi-agent designs amplify the problem in three specific ways. They launder taint: raw hostile text goes in one end and an authoritative-sounding internal summary comes out the other, stripped of the provenance that would have made a reviewer suspicious. They lengthen the chain between the untrusted source and the consequential action, so the human reviewing the final step has no visibility of where the instruction originated. And they aggregate capability, because each agent carries its own tools, so the union of what the system can do is larger than what any single agent was reviewed for.

• Propagate a taint label with every inter-agent message, set the moment an agent reads anything untrusted, and never clear it on the way through.
• Refuse to let a tainted message authorise a privileged action. It may inform an answer; it may not select a tool or supply its arguments unchecked.
• Apply tool allowlists and credential scope at each agent, not only at the system perimeter. The perimeter is not where the tools are.
• Keep the human gate at the point of the side effect, not at the top of the plan, so the approval sees the real action rather than an intention.
• Preserve provenance end to end so an investigator can trace an executed action back to the document that suggested it.

Be candid about where this leaves us. Containment of injection propagation across cooperating agents is an active area of research and there is no settled solution; taint tracking through natural language is inherently coarse, since a summary carries influence in ways no label fully captures. The defensible engineering position today is conservative: minimise the capability available in any session that touches untrusted content, keep the chain between untrusted input and consequential action as short and as visible as you can, and assume that anything downstream of a hostile document is speaking with the attacker's voice.