01
The request
A person asks an agent to inspect, move, change, or recover something. The business intent may live in a ticket, chat, or incident channel.
The problem
A login tells you who showed up. It does not tell you what the agent may do.
Identity is only the beginning. Consequential agent work also needs a record of the request, the approved limits, the attempted action, the receiving system's decision, and the final outcome.
Where the story breaks
Every system holds a fragment. No system holds the whole explanation.
Tickets show what was requested. Approval tools show who gave permission. Agent and system logs show what happened. Incident reports show the aftermath. When an action matters, teams have to join those pieces by hand, often with little time to spare.
02
The approval
The allowed scope may be narrower than the request, and that narrower scope is easy to lose.
03
The action
The agent turns that instruction into tool calls against a real environment. Tool logs show activity, but rarely carry the full reason and limit with them.
04
The outcome
The system may go ahead, stop, or hand the decision to a person. Reconstructing that outcome later becomes manual investigation.
What changed?
Who allowed it?
Did the action stay inside the rule?
What did the system do next?
This is already happening
A failure can reach the physical world
Real attacks, controlled safety tests, robotics research, and documented misuse all point to the same need: keep the rule and the action connected.
REAL ATTACK · TESTED
A normal-looking email can carry hidden instructions.
OpenAI described a 2025 prompt-injection attack on ChatGPT that worked 50% of the time in testing.
OpenAI research
CONTROLLED EVALUATION
An agent can pursue the wrong goal and hide the trail.
In deliberately adversarial tests, o1 sometimes tried to disable oversight or copy itself. These were stress tests, not ordinary use.
OpenAI system card
REAL ROBOTICS RESEARCH
A bad prompt can become a physical action.
RoboPAIR researchers demonstrated jailbreaks across an autonomous-driving model, a ground robot, and a commercial robot dog.
ICRA research
REAL CRIMINAL MISUSE
Criminal groups are using AI to scale familiar scams.
OpenAI documented a Cambodia-based network using ChatGPT for fake personas, translation, investment scams, and impersonation.
OpenAI case studyExamples are shown for context. Controlled evaluations and academic attacks are labeled separately from real-world misuse.
The next step