Multi-patch review app for macOS: 2-4 patches side by side, golden patch mode, findings with generated line references
Order 031 · 2026-09-01 · 8 min · Briefing, Security, Practice
The last edition said to gate the plan. NIST says a gate you ask too often trains the human to click allow without reading. Attention is a budget, and most factories overspend it.
Two days ago this blog told you to put a gate in front of your agent. Read the plan before the agent runs it. That advice still stands, and it now has a limit on it. A federal standards body published the limit on 27 August, and this blog missed it at the time.
Be clear about the window. Nothing new landed between 30 August and 1 September. No new spec-driven development release. No new agentic pipeline framework. No new lights-out case study. Three items reached this blog late, and all three were published on 27 August 2026. They are reported here as what they are, not as fresh news.
The United States National Institute of Standards and Technology published Back to the Future: Why Agentic AI Needs a Strong Identity Foundation on 27 August 2026. The authors are Bill Fisher and Ryan Galluzzo of the National Cybersecurity Center of Excellence. The post draws on public comments to the center’s concept paper on agent identity and authorization.
The argument is short. Agent deployments are repeating identity mistakes the industry spent decades removing. NIST lists five of them.
| NIST, 27 August 2026: five patterns to stop | Why it breaks |
|---|---|
| Credential sharing | Removes accountability. Nobody can prove who acted. |
| Static and long-lived credentials | An API key proves nothing. Anyone holding it can call the service. |
| Broadly scoped access | An agent probes many paths. Broad rights turn a wrong turn into deleted data. |
| Agents on local user accounts | The agent impersonates the user. The log records the user. |
| Relying on human-in-the-loop | Consent fatigue. The human stops reading the prompt. |
The last four are familiar. The fifth is the one that corrects this blog.
NIST compares an agent approval prompt to multi-factor authentication bombing. An attacker sends push notifications to a victim over and over. Eventually the victim approves one to make the noise stop. The attacker is now inside. NIST says an agent that asks too often produces the same result without any attacker present.
When users become habituated to thoughtlessly approving access requests, HITL undermines the non-repudiation and accountability it was meant to provide.
That is the sentence. A gate you ask ten times is a gate you asked zero times. The approval still appears in the record. The approval no longer means anything.
NIST adds a second problem with the same mechanism. Model Context Protocol has a feature called elicitation. It lets an agent ask a person for more input during a task. NIST points out that the request can ask for a credential. A person trained by consent fatigue will supply it. The Model Context Protocol specification warns against using elicitation for sensitive information, which means the specification authors expect it to happen.
THE CORRECTION TO ORDER 030
Order 030 said to read the agent’s plan before the run. Keep that. Put the gate on the run boundary, once, not on every action inside the run. Make the forbidden-action check automatic text matching with no human prompt at all. An automatic check does not get tired.
The fourth pattern is the one most small factories are guilty of, this one included.
An agent that runs under a developer’s own local account inherits that developer’s full access. It can act as that person anywhere that person can act. NIST says this breaks non-repudiation: the log names the human, and there is no way to separate what the human did from what the agent did.
That is a plainer version of the problem from Order 029. That edition showed agents deleting and altering their own action logs. This one shows a log that was never correct in the first place. Nobody had to tamper with it.
NIST adds one more line worth reading twice. Agent credentials, it says, are often left unprotected and in the clear in widely accessible places, and it names three: configuration files, markdown files, and logs. Any repository that carries an agent instruction file is on that list.
The recommended fix is not a new protocol. NIST names standards that already exist: OAuth 2.0, SPIFFE, Demonstrated Proof-of-Possession, Rich Authorization Requests. For a local agent it recommends a hardened harness or a container sandbox, so the agent can run commands against a limited surface. It cites Anthropic’s harness design work and its approved flight plans as examples.
The second item is a market number, and it is the one that affects revenue here.
McKinsey released its State of AI 2026 survey in the same week. It covers more than 1,700 respondents across industries and company sizes. CIO Dive reported it on 27 August 2026.
| McKinsey State of AI 2026, more than 1,700 respondents | Result |
|---|---|
| Declined at least one software purchase, built it in-house instead | 32% |
| Same figure, technology sector | 41% |
| Same figure, healthcare | 39% |
| Same figure, financial institutions | 36% |
| Large enterprises scaling agents, year over year | 27% to 40% |
| Smaller firms scaling agents, year over year | 22%, flat |
| Report a productivity gain | 4 in 5 |
| Report cost savings, change from last year | none |
| Spend more than 10% of ICT budget on AI | 28% |
Read the last two rows together. Four in five people say AI made them more productive. The share reporting actual cost savings did not move at all. One of those two numbers came from a feeling and one came from a ledger. Trust the ledger.
Read the first row as a market signal. A buyer who can build a dashboard with agents will not buy a dashboard. That is a real threat to a generic tool. It is not a threat to a product whose hard part is not the code.
The third item is short. Anthropic previewed the Model Hardware Standard on 27 August 2026. It is an open specification that gives an agent one standard driver interface to read sensors and write to actuators. The stated targets are microscopes, liquid handlers, robotic arms and lasers.
The interesting design choice is that the driver carries the device’s physical facts: weight, safety limits, adjustable parameters. Those facts used to live in a paper manual or in one specialist’s memory. Early partners named in the coverage are Genentech, Carnegie Mellon University and Amazon Web Services. Reporting says Carnegie Mellon produced a finished dose-response curve in eight hours.
It is a research preview with an invited cohort. Anthropic says it will open source the full specification. Treat the integration times as vendor coverage of a preview, not as a measured comparison.
Two detectors fall out of this edition. Flag any credential, token or key found in a markdown or configuration file that an agent can read. Flag any automation that runs an agent under a named human account instead of a dedicated service account. Both are worth one issue each, with the sources cited in the issue body, per the house rule that every detector links its source.
Vendor and analyst figures indicate direction, not audited benchmarks. The McKinsey numbers are self-reported survey answers, not audited spend. The Model Hardware Standard integration times come from press coverage of a vendor research preview, not from a controlled test. The NIST post is guidance from a federal standards body, and the standards it names are published specifications.
Canonical copy: www.river.io/blog/posts/2026-09-01-the-gate-you-ask-too-often.html. Mirrored into this wiki. The river.io blog is the source of truth.