Approval UIs can approve a different object than the one that executes: APAS-Finder checks that the approved version reaches the sink

arXiv 2609.26529·medium signalXBlueskyLinkedInCopy link

Workflow reloads, transcript projection, argument rebinding and state lookups can rebuild an agent action after a human approves it. A repair that checks every field can therefore still leave an authorization bypass. The paper defines reconstruction-stable authorization and builds APAS-Finder, whose predictions matched all 28 controlled outcomes. Five correct repairs blocked 60 of 60 out-of-scope effects. When you add human approval, bind the approval to the exact object version that is consumed, for example with a nonce or hash checked at execution time, not to the record that was displayed.