Learning goal: design a boundary between an AI assistant's proposal and an authorised business change.

Fictional scenario

An assistant reviews purchase orders and suggests moving a delivery date. A supporting document contains an unrelated instruction about the approval process. The document is data, not a source of authority. Which component decides whether the proposed change is allowed?

Architecture options

  1. A: direct writes. Simple, but too much autonomy for consequential actions.
  2. B: action gateway. An independent application checks the proposal against user permissions, business rules and required human review. Recommended.
  3. C: read-only assistant. Prepare a draft for the existing business workflow where approval infrastructure is not ready.

Six responsibilities

  1. Read: restrict access to the necessary data.
  2. Propose: describe the target, original value, requested value and rationale.
  3. Authorise: verify identity and business policy in application code.
  4. Approve: show the precise parameters to the reviewer and bind the decision to one revision and expiry.
  5. Execute: revalidate current permissions and state, and track the operation identifier.
  6. Audit: retain the initiator, reviewer, policy version, decision and outcome without secrets.

A review decision does not replace target-system authorisation. A later change in parameters or permissions requires re-evaluation.

OWASP Agent Control Standard

OWASP announced the Agent Control Standard (ACS) on 1 September 2026. Its three areas are Instrument, Trace and Inspect. The published specification is v0.1.0 and should be treated as an early reference for architecture pilots, not as a certification. The core gateway pattern can be implemented independently.

Acceptance tests

  1. Instructions inside documents cannot grant authority.
  2. A changed request requires a new review.
  3. Expired permissions prevent the action.
  4. An unclear outcome is checked before another attempt.
  5. A policy-service outage holds high-impact changes.

ADR: choose B for controlled write operations and C for the rest. Extra infrastructure and review latency are the trade-offs. The acceptance condition is a verified single path for changes.

Architect's question: which independent component can reject the proposal?

Sources

Sources verified 18 October 2026. Fictional scenario; no production claims.