Parameter-Bound Human Approval

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R41 — OWASP Agentic HITL & inter-agent trust

   R22 — OAuth context binding

   R21 — MCP context

   R27 — OpenTelemetry trace correlation

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Add human-in-the-loop (HITL) approval gates for consequential actions. Bind the cryptographic approval token to the exact tool_name, target_resource, and canonical_parameters_hash. *Lab:* Test TOCTOU (changing a parameter after approval) and approval replay.

   Implement message-bus (D3) with typed envelopes (sender_id, recipient_id, workflow_id, provenance, trust_label, schema_version). Enforce capability separation so an untrusted research sub-agent cannot directly instruct a privileged execution sub-agent.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 37 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Approval TOCTOU/replay tests + D3 inter-agent spoofing and cross-workflow isolation test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

• R22OAuth 2.0 Security BCP (RFC 9700)↗ rfc-editor.org

  RFC 6749 core flows + RFC 9700 security best practices: narrow scopes, audience restriction, token leakage, and replay.

• R27OpenTelemetry Documentation↗ opentelemetry.io

  Traces, spans, context propagation, semantic conventions, and redacting sensitive attributes.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP · ~20 min read
  AI Agent Security - OWASP Cheat Sheet Series

  Its human-in-the-loop section requires binding approval to actor, tool name, target resource, normalized parameters, timestamp and expiry — the parameter-bound approval token contract verbatim.

  R41checked 2026-11-11
• videoLangChain · ~12 min
  LangGraph interrupt: Making it easier to build human-in-the-loop agents

  Shows `interrupt()` pausing a graph, checkpointing state and resuming via `Command`, the pause boundary you attach an approval record to.

  R21checked 2026-11-11
• videoGrabDuck! · ~20 min
  LangGraph Advanced – Use Dynamic Human in the Loop Interruption in Prebuilt AI Agents

  Gates only risky tool calls dynamically and resumes after approve or cancel, which is the routing rule for which actions need a human gate at all.

  R21checked 2026-11-11
• articleWorkOS · ~12 min read
  How to add human approval to async AI agent actions

  Treats an approval as a single-use token bound to a specific action with a short `requested_expiry`, the model for defeating approval replay and stale TOCTOU windows.

  R22checked 2026-11-11
• labOpenAI · ~20 min read + code
  Human-in-the-loop - OpenAI Agents SDK

  Implements pause/approve/resume with serialize state and explicitly warns that a transported approval snapshot must be integrity-checked, bound to the user and run, and made replay-proof.

  R41moved 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.