Talk at [un]prompted 2026 at The Hibernia in San Francisco on why an agent-generated approval is not evidence that a human participated. When an AI agent inherits its operator's UID, groups, environment, and credentials, an approval dialog alone is not a security boundary.
The talk walks through building and trying to break an MCP permission broker: a service-owned reference monitor, capability-scoped and session-bound grants, and phone-generated codes as evidence of human presence. It covers agent-authored approvals, adversarial boundary tests, and replay rejection, alongside the other half of the problem: ensuring the legitimate human approval path actually works. A historical database migration bug illustrates why testing denials and passing health checks are not enough.