Segregation of duties for AI agents
Enforce four-eyes and dual-approval controls on an autonomous agent at the API layer — not the UI — so the agent can never self-approve.
Guardrails enforced in the UI are trivially bypassed by an agent that calls the API directly. Split a large order into sub-materiality slices and a naive notional check waves it through.
Segregation of duties is checked server-side on every request: the approver identity must differ from the agent caller, and T3 irreversible actions require two distinct approvers with a manager role on at least one. A session-aggregate materiality ledger closes the split-trade bypass by tracking cumulative notional across the session.
The governed lifecycle for this pattern.
- 01
Agent requests approval
The API — not the UI — is the enforcement point for every HITL request.
- 02
Approver identity is verified
A self-approval attempt returns 403 and writes an audit row counting toward AIR-OP-18.
- 03
Aggregate materiality is tracked
Cumulative notional within a session triggers HITL even when no single slice does.
- 04
Dual-HITL for irreversible actions
T3 needs two distinct approvers, both distinct from the caller.
The agent is fast, but it can never approve its own irreversible actions or slice its way past a materiality threshold.