Every control in the stack validates the shape of the action and none validates its target. A refund of the right amount, to a real customer, through a permitted tool, against the wrong account, is indistinguishable from success at every layer that is watching.
Updated Aug 2026 · Grounded in real Forward Deployed Engineer interview loops and written to a senior-engineer editorial bar.
Every control in the stack validates the shape of the action and none validates its target. A refund of the right amount, to a real customer, through a permitted tool, against the wrong account, is indistinguishable from success at every layer that is watching.
The sentence to listen for is some version of 'the guardrails check the verb, not the object'. Every control in a normal agent stack validates the shape of the action: is this a permitted tool, does the payload match the schema, is the amount inside the cap. Not one of them validates that the identifier in the payload is the entity the human meant. Candidates who go looking for a bug in the tool layer will not find one, because there is not one.
No comments yet — be the first to share your approach.
