BankInfoSecurity published a sharp analysis this month on AI agents as the new insider threat. The case is well made. AI agents operate inside the perimeter with elevated privileges, at machine speed, at horizontal scale, with emergent behaviour that makes traditional baselining unreliable. A single misconfigured agent, or one manipulated via indirect prompt injection, can execute thousands of coordinated actions across cloud environments before a human analyst has finished reading the first alert.¹
The piece works through four dimensions of how agents differ from human insiders - speed, scale, emergent behaviour, and the collapsed skill gap - and then arrives at a mitigation framework. Most of it is downstream: AI-native monitoring, runtime sandboxing, dynamic permissioning, output filtering. Detect, contain, limit blast radius.
Then, buried in the process controls section, one sentence: “For high-impact actions, such as deleting data, changing financial records or altering security configurations, there must be a mandatory human approval step. We can’t cede the kill switch to the machine.”¹
That is the most important sentence in the piece. It is also the least developed. The author names the right control and moves on. The question it leaves unanswered is the only one that matters operationally: what does mandatory human approval actually look like when the agent is executing at machine speed, when the instruction channel may itself be compromised, and when the approval needs to be cryptographically verifiable rather than procedurally assumed?
The answer cannot be email. If the agent is operating inside a compromised or manipulated environment, the email channel carries the same risk. An attacker who can manipulate the agent can manipulate the approval request that travels through the same system. The approval becomes theatre - a record that something was confirmed, with no guarantee that the right person confirmed it or that they understood what they were confirming.
The answer cannot be a dashboard approval either. A dashboard sitting inside the same technology estate as the agent is subject to the same attack surface. Approval through the same channel as the instruction is not out-of-band confirmation. It is the same channel with an extra click.
Mandatory human approval for high-impact agentic actions requires three things to be meaningful. First, the confirmation must travel through a channel that is physically and architecturally separate from the environment the agent is operating in - a registered personal device, not a browser tab or an inbox. Second, the confirmation must be biometrically verified so that the named authority cannot be impersonated. Third, the confirmation must be cryptographically bound to the exact action payload so that a captured approval cannot be replayed against a different or modified action.
GoFirm provides exactly this. When a developer embeds the GoFirm SDK into an agent workflow at a high-consequence action threshold, the agent calls the confirmation endpoint with the action details and the named human authority. GoFirm routes the request to that authority’s registered personal device - separate from the operational environment. The authority reviews the exact action parameters and confirms with their biometric. The agent receives a signed response. No positive confirmation means no execution. There is no fallback path.
Every confirmation is signed, timestamped, and written to an immutable audit trail. The attribution problem the article identifies - forensics cannot tell whether a service account action was legitimate, a developer error, or external manipulation - is answered at source. The audit record shows who confirmed the action, on which device, with biometric verification, at the exact moment of execution. That record exists before the question is asked, not reconstructed after the incident.
The article is right that the challenge is not to stifle AI adoption but to govern a digital workforce. Governing a digital workforce means the same thing it has always meant for human workforces: consequential actions require confirmed authority from a named person who understands what they are authorising. The mechanism for that confirmation needs to be technically enforced, not procedurally stated.
One sentence identified it. The mechanism exists.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai, the collective intelligence platform for Security, Resilience & Defence. Osinto’s AI-enabled open-source network and governed collaborative operational environment help mitigate the growing security, resilience and governance obligation in minutes, not months.
References
1. BankInfoSecurity, AI Agents Are the New Insiders, June 2026, https://www.bankinfosecurity.com/blogs/ai-agents-are-new-insiders-p-4127