AEW-003

Execution authority collapsed into capability to prepare

The capability to prepare a consequential change and the authority to make it take effect are held by the same actor, so the review seat that separated them goes empty.

Status: publishedExecution AuthorityApproval ControlsHuman Oversight

Description

Many established workflows separate preparing a change from executing it: a plan is produced, a human occupies the reviewer's seat, and only then is the change applied. That separation is a control only while a different actor consumes the plan than the one that produced it. When an agent is delegated both halves, the review step still appears to exist but no longer functions, because the actor that reasons about the change is the actor that commits it. The weakness also appears when a product carries a change to the very edge of taking effect and describes a human sign off, without any mechanism that prevents the change proceeding if the sign off is absent. Capability to prepare is not authority to enact, and collapsing the two removes the last layer that made the workflow safe.

The authority gap

Authority to prepare a change is treated as authority to enact it, so the separation of duties that made the workflow safe is present in form and absent in effect.

Failure conditions

An agent both produces a consequential change and executes it, with no independent actor between.
A described sign off has no mechanism that blocks the action when it is missing.
The reviewer's seat exists in the workflow but is occupied by the same actor that generated the work.

Consequences shown by the evidence

Production infrastructure destroyed because plan and apply were delegated to one agent.
A change carried to the edge of production with no enforced gate before it ships.

Detection signals

The same actor appears as both author and approver of a consequential change.
A sign off is described in product material but no artifact defines what enforces it.
Remediation after an incident consists of taking back the execution half rather than removing the agent.

Known examples

A developer delegated both terraform plan and terraform destroy to Claude Code; his own fix afterwards was to run destructive commands himself.
Slack Code lets an agent assemble a plan, branch, diff and preview and describes an expert sign off before production, with no published mechanism that enforces it.
Anthropic's open commerce agents reference code keeps a merchant agent's staged writes behind a host controlled approval mark that a preview card or chat text cannot set, the same separation this weakness names, applied to storefront and back office state rather than to infrastructure or a code deploy.
Google's Gemini Spark, extended to Google Photos from 3 September 2026 per Google's own Gemini Apps Help material and corroborated by TechCrunch's 4 September 2026 report, documents the same separation for a personal photo library: Spark searches, curates, filters duplicates, edits images as new copies, and creates and organizes private albums directly, but is documented as asking for the user's permission specifically before sharing an album or sending an email, with new albums private by default and edits saved as copies rather than overwriting the original. Both support.google.com and techcrunch.com were blocked to direct fetch at this session's network egress proxy; this example rests on convergent, independently phrased web search corroboration rather than a direct read of either page, held at the manual-review evidence level throughout.
The Supreme Court of New Mexico's Dispositional Order of Direct Contempt in State v. Sandoval, S-1-SC-40845, decided 9 September 2026, extends this weakness for the first time from an agent holding both roles to a human professional who did. Attorney Stephen Aarons used ChatGPT to prepare an appellate brief containing, in the order's own words, false testimony from wholly fabricated witnesses and misrepresented legal authority, and admitted he did not verify the factual claims and legal authority before he signed and filed it. No agent executed anything here; the collapse is that the professional's own separate verification duty, the step meant to stand between a prepared draft and a filed, consequential representation to a court, was not performed. The court held Aarons in direct contempt, struck all briefing filed in the matter, replaced him as counsel, referred him for professional discipline, barred him from appearing before the court pending that process, and imposed a five thousand dollar sanction.
Cheche Group's own investor relations material, an ABAO Agent announcement published 22 June 2026 and a follow on ABAO Agent Family announcement published 1 September 2026, states that its renewal agent's 24/7 autonomous capabilities allow it to independently execute the complete renewal workflow, customer outreach, needs identification, policy follow up and conversion, with no separate approval step described anywhere in either announcement between preparing the renewal, needs identification and strategy, and enacting it, conversion. The 1 September announcement adds a claims agent that automates the first notification of loss, the damage assessment and real time claims status updates, states the platform separately enables second level damage assessment and intelligent loss calculation, and adds an underwriting and pricing agent producing decision grade risk analysis and renewal strategy from more than 200 dynamic risk control factors including ADAS and ADS operating data. Per this record's own admitted evidence bundle, the same announcement describes the claims platform as live with Volkswagen Anhui and Avatr and integrated with PICC, Ping An and China Pacific Insurance, and the pricing agent as commercially deployed across more than 100 cities, a commercial scale this weakness's existing known examples have not yet reached. This is vendor reported material, admitted through this record's own upstream EVIDENCE_BUNDLE rather than an independent direct fetch of ir.chechegroup.com in this session, and it extends the weakness in one respect the existing known examples do not: three separately named agents, each bounded to a different insurance action, renewal, claims and underwriting and pricing, rather than one agent holding every role, so the question this weakness asks has to be asked action by action across the workflow rather than once for the whole of it. Neither announcement states whether conversion is the renewal agent itself binding a policy or a handoff to a separate confirming system or person, whether any approval in the workflow binds to the exact terms the agent later executes, whether a change in the underlying vehicle or ADAS data after a decision grade assessment is produced invalidates that assessment before it is relied on, or whether authority delegated by one organisation in this chain, an automaker, an insurer or Cheche itself, propagates to another's own binding system. This record states each as unknown rather than inferred.

Recorded instances

AEV-2026-0006 Claude Code ran terraform destroy against restored production state AESS 6.8 medium Observed
AEV-2026-0064 An attorney signed and filed a ChatGPT drafted appellate brief with fabricated witness testimony, unverified AESS 4.9 medium Confirmed

Protocol evidence

Published authority architectures whose artifacts bear on the requirement this weakness names: which satisfy it, which expose a way past it, and which leave it unanswered.

Supports requirement
Agent Infrastructure Control Protocol (AICP)
Tihan-Nico Paxton, Apollo Deploy (individual submission to the IETF)
Requirement Capability discovery is explicitly separated from an authorization grant
This weakness names the collapse of capability to prepare into authority to enact. AICP's own Section 6.3 states the corrective directly for the discovery stage specifically: a capability listing indicates discoverability, not a durable authorization grant, and policy is evaluated again when planning and immediately before execution. Section 4.2 restates the same boundary as a provider obligation, that authority must be derived from authenticated server side context rather than granted because a request body claims it. Recorded as design evidence for the requirement this weakness already states, not as a claim that any provider has implemented this draft's text.
View protocol evidence
Reveals bypass
Slack Code, code channels and expert sign off for high stakes actions
Slack, a Salesforce company
Requirement Slack itself is the point at which the production decision is enforced
Slack Code carries a change to the edge of production and describes an expert sign off, but Slack is not the point at which the deployment is enforced, and no artifact binds the sign off to a refusal on the far side. The weakness names exactly that gap.
View protocol evidence

Most direct sources

How I Dropped Our Production Database and Now Pay 10% More for AWS (Alexey On Data)
Slack Code: Where Your Team and Agents Build Together (Slack)
commerce-agents: Safety, what the reference code enforces and what it asks the model (Anthropic, commerce-agents repository)
Streamline your Google Photos workflows with Gemini Spark (Google, Gemini Apps Help)
Google's Gemini Spark can now manage your Google Photos library (TechCrunch)
State v. Sandoval, S-1-SC-40845, Dispositional Order of Direct Contempt (Supreme Court of New Mexico) (Justia)
Cheche Group Launches ABAO Agent Family, Deploying AI Across the Full NEV Insurance Value Chain (Cheche Group Inc.)
Cheche Group Launches "ABAO Agent," an AI-Powered Intelligent Underwriting Solution (Cheche Group Inc.)

Related weaknesses

AEW-001 Action without applicable policy
AEW-005 Approval not bound to the executed action
AEW-011 Evidence after the fact mistaken for authorization before it

Change history

2026-08-30
Created from the retrospective backfill; the plan and execute separation recurs as a control that collapses under delegation.
2026-08-30
Published: evidenced by a concrete failure and a shipped product that describes the sign off without enforcing it.
2026-09-03
Added Anthropic's open commerce agents reference implementation, published 2 September 2026, as mitigation evidence for this weakness: a merchant agent's staged writes require a host controlled approval mark that the agent's own conversation surface cannot set, and the documentation states plainly that a preview card and an approval typed in chat set nothing. Treated as an example of the response pattern this weakness already names, not as a new weakness; the same documentation states the separation is a configurable default rather than a fixed property, which this record's own supporting article states at the same scope.
2026-09-06
Added a fourth known example and a new supporting record and source URLs: Google's Gemini Spark, extended to Google Photos from 3 September 2026 per Google's own Gemini Apps Help material (support.google.com/gemini/answer/18116629) and corroborated by TechCrunch's 4 September 2026 report, documents the same prepare/enact separation this weakness already names for a personal photo library: autonomous search, curation, duplicate filtering, copy-based editing and private album creation and organization on one side, a human confirmation step specifically before sharing an album or sending an email on the other, with new albums private by default and edits saved as copies rather than overwritten originals. Both support.google.com and techcrunch.com were blocked to direct fetch at this session's network egress proxy on every attempted route; this example rests on repeated, independently phrased web search passes whose result snippets converge on consistent wording for Google's own documentation and TechCrunch's own report, held at the manual-review evidence level throughout rather than treated as a direct read of either primary text. This record does not claim the confirmation step cryptographically binds the exact album, recipient, content or permission level presented for review, and does not claim scheduled or recurring Spark workflows are documented as sharing or sending without the same confirmation step a one-shot prompt would trigger; both are stated as unknown rather than inferred (Risks assessment: VALIDATE, CONNECT; evidence delta IMPLEMENTS, STRENGTHENS).
2026-09-12
Added a fifth known example and a new supporting record and source URL, from a Moona Intelligence Radar signal admitted through the canonical upstream EVIDENCE_BUNDLE path (admitUpstreamEvidenceBundle), not independently re-fetched in this session: the Supreme Court of New Mexico's Dispositional Order of Direct Contempt in State v. Sandoval, S-1-SC-40845, decided 9 September 2026, corroborated by the court's own recordings-of-oral-arguments docket listing and by Reuters' independent reporting of the same five thousand dollar sanction. Attorney Stephen Aarons used ChatGPT to prepare an appellate brief containing false testimony from wholly fabricated witnesses and misrepresented legal authority, and admitted he did not verify either before signing and filing it. This is the first known example where the actor occupying the separate role is a human professional rather than an agent delegated both halves: no agent executed anything, and the collapse is that Aarons' own required, independent verification step between an AI-assisted draft and a signed, filed, consequential court document was not performed. Recorded here rather than as a new weakness because the authority gap is the identical one this weakness already states, authority to prepare a document treated as authority to file it; only the identity of the actor who let the two collapse differs from the four existing known examples. Connected to the new AEV-2026-0064, which instantiates this weakness alone.
2026-09-13
Added a sixth known example and a new supporting record and source URLs, from a Moona Intelligence Radar signal admitted through the canonical upstream EVIDENCE_BUNDLE path (admitUpstreamEvidenceBundle), not independently re-fetched in this session: Cheche Group's ABAO Agent announcement (22 June 2026) and its follow on ABAO Agent Family announcement (1 September 2026) state a renewal agent that independently executes the complete renewal workflow end to end, customer outreach, needs identification, policy follow up and conversion, with no described approval step between preparing the renewal and enacting it. The family announcement adds a claims agent automating first notification of loss, damage assessment and loss calculation, and an underwriting and pricing agent producing decision grade output from more than 200 dynamic risk control factors including ADAS and ADS data, at a commercial scale spanning named insurer and automaker partners. Recorded as a sixth known example of this weakness's own authority gap rather than a new weakness: the pattern is the one already stated here, capability to prepare treated as authority to enact, now evidenced across three separately named, action bounded agents in one commercial deployment rather than one agent holding every role. No AEV applies: neither announcement describes an incident, a bypass or an exploited defect, only a vendor's own launch material whose downstream approval binding, evidence change invalidation and cross organisation authority propagation this record states as unknown rather than inferred. Raw signal bytes captured through captureRadarSignalArtifact at sha256:d20355fde2793276aad8a9cd096f2456154d19f47316dd63648f2b1950d67a83 (ABAO Agent, 22 June 2026, occurrence occ-moona_intelligence_radar-d20355fde279-2) and sha256:63e5a96418385f3d20200cfc489cff2991f3c098c227a5f7872222ff9acbf0c6 (ABAO Agent Family, 1 September 2026, occurrence occ-moona_intelligence_radar-63e5a9641838-1). Protocols: NO_CHANGE, this weakness already carries protocol coverage and nothing in market-intelligence.ts addresses this mechanism directly.