Requirements
- Every message that arrives belongs to exactly one session.
- The system checks that the sender of a message has the standing to direct that session.
- The system checks every decision on an approval request against who may decide that question. The check is the same however the decision is submitted.
- Who someone is comes from the place the conversation lives, and not from what a message claims about its sender.
- A request that waits on a person survives a restart of whatever serves it.
- A reply that arrives much later finds the same session.
- A reply that arrives after the session has ended starts a continuation, and that continuation carries the history forward.
- The agent that asks for approval does not write what the approver reads about the action.
- Anything the agent says is labeled as its own words.
- Permission requests and other out-of-band controls are marked distinctly from any interface the agent can produce.
Security considerations
Assume an attacker can reach the conversation surface, and can submit messages and decisions on it. The approval surface is trusted for two separate things: who decides, and what the decider is told. An approval grants the access at once, so the check on who submitted it is the last control before the action runs. The agent is trusted for neither. An agent that wrote its own approval request would describe a dangerous action in harmless terms. An approver who cannot be distinguished from the requester approves the requester's own work.
Residual risk: This primitive bounds who may decide, and what they are shown. It does not make the decision correct.
Non-qualifying systems
Commonly substituted components: a chat connector, or a bot that reads and writes strings on a pipe. Any of the following disqualifies a system:
- Who the sender is comes from what the message claims, or from the chat service alone.
- Anyone who can see an approval request can decide it. This includes the person who asked for it.
- The agent writes the words the approver reads.
- A restart of whatever serves the conversation leaves a person with an approval request that nothing will act on.