GhostApproval — Agent Failure Series #17

When agents don't wait for you — how approval gates silently fail in production

Agent Task Queue

Approval Gate

Endpoint: POST /api/approvals/request

Idle — waiting for task

No active approval request

Vulnerable Code Pattern

# Select a failure mode to see the vulnerable code

Damage Log — Actions Without Approval

No unauthorized actions yet.

✅ The Fix: Defense-in-Depth for Approval Gates

1. Strict Status Matching

Never use != 200 for the fail path. Whitelist exact success codes. Anything outside that set — including 202, 204, 301, or 500 — is an explicit denial.

2. Timeout = Deny

Approval timeout must default to denial, never continuation. Redesign: on_timeout="deny" and surface a visible error. Never continue_on_timeout.

3. Exception = Halt

Replace bare except: pass with explicit handling that raises an ApprovalRequiredException. Never swallow exceptions in security-critical paths.

4. Per-Action Approval Tokens

Issue single-use cryptographic tokens per consequential action. Cached approvals are attack surfaces. Approve once, execute once, expire immediately.