AI Agent Security (Course)
Approval Binding
Also: content-bound approval
What an approval is attached to: a name or path that can change under it, or a fingerprint of the exact content that was reviewed.
In more detail
If approval is bound to a label such as an MCP server's name, changing the command behind the label inherits the old approval, so a harmless entry can be approved and then swapped. Binding approval to a hash of the whole entry makes any change, even one character, require a new decision. The same idea underlies lockfiles and commit pinning, and it fails in the same way when the pin is not verified after the fact.