AI Agent Step-Up Approval Lab: What the Approver Must See
This is a hands-on lab about approving risky AI agent actions. A valid identity tells you who is calling, not whether the action is allowed. You make 12 scored calls on which actions need independent approval, what the approver must see, and where the check must live.
It draws on what Binance said about its 29 October 2026 incident (an initial report, subject to independent review) and on Elliptic’s analysis. Read the wider picture in our Binance hack coverage, then test your own controls with the Signing Service Controls Checklist and the EIP-7702 Delegation Risk Explainer.
You are Marcus Idowu, head of security engineering at Meridian Custody, a fictional digital-asset custodian. Its treasury agent, Ledgerly, prepares transfers, rebalances and access changes for a small operations team, and calls an internal signing service to execute them. After Binance said an attacker used unauthorized access to an internal wallet signing service to start transactions outside its normal withdrawal process, your board wants to know which agent actions need an independent human approval, what the approver must see, and why a valid identity is not enough. Over 12 scored decisions you design the approval step. Everything is invented and no attack steps appear. Each call scores 0 to 10 with the source behind the feedback.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this is
5 points
- A scenario lab about approvals for AI agents: which actions need an independent human approval, what the approver must see, and why a valid identity or access to a signing service is not authorization.
- You make 12 scored decisions: authentication versus authorization, which actions to gate, showing the real action instead of the agent's summary, a change in delegated authority that moves no money, an independent approver and channel, binding approval to the exact request, enforcement inside the signing service, limits, approval fatigue, monitoring authority changes, emergency pause and the board report.
- It draws on Binance's own account (what Binance said in its post dated 4 November 2026, an initial report subject to independent review), Elliptic's analysis, OWASP guidance on excessive agency, NIST SP 800-207 and the MCP security best practices.
- Free to play, no account needed. The company, agent and wallets are invented. No attack steps appear.
- Defensive and educational only. It names no organisation as failing a control.
How this differs from our other agent labs
The Signing Service Controls Checklist scores a custody environment against a control list. This lab is a scenario: you design the approval step for an AI agent and see where each choice fails. The EIP-7702 explainer covers the delegation mechanism itself.
The Agent Tool Scope Lab decides which tools an agent has; the Agent Governance Plane is a policy layer for agents in general. This lab focuses on one control inside that layer: independent approval that cannot be steered by the agent. Credentials are covered in the Agent Credential Broker Lab and stopping a run in the Agent Kill Switch Drill Lab.
Frequently asked questions
What is step-up approval for an AI agent?
It is an extra, independent approval required before an agent action with high impact is carried out, such as an external transfer, a new destination, a change to limits or a grant of delegated authority. OWASP's guidance on excessive agency recommends requiring a human to approve high-impact actions before they are taken.
Why is a valid identity not authorization?
A valid identity shows who is calling. Authorization decides whether this action, on this target, is allowed now. Binance said an attacker used unauthorized access to an internal signing service to start transactions outside its normal withdrawal process, and Elliptic says its analysis indicates the attacker induced Binance's systems to sign rather than stealing private keys. The lab uses that pattern to show why the signing service itself needs to check policy and approval.
What must the approver see?
The real action produced from the request that will execute: the action type, the target account, the destination, the amount, and any change in delegated authority, plus what differs from similar past requests. The agent's own summary can be shown, labelled as the agent's. This is PlayCISO practice, not a quote from a source.
Is suspending the agent or withdrawals enough?
Not by itself. Binance said suspending withdrawals alone could not stop the attack because malicious EIP-7702 authorizations existed on-chain independently of its withdrawal system. The Kill Switch Drill Lab covers revoking authority that was already granted.
Does this lab say how Binance was breached or who is to blame?
No. It relays what Binance said in an initial report that Binance describes as subject to independent review, and what Elliptic says its analysis indicates. We could not open Binance's page with an automated fetch, so the detail comes from text supplied by the PlayCISO owner and is worded as Binance's statement. The fictional company in the lab is not Binance.
How is the lab scored?
Each of the 12 decisions scores 0 to 10 and the result is your share of the maximum, with a band that says what it means. The debrief shows the source behind each rationale.
Sources
All read on 4 November 2026. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional. We cite primary sources, not vendor advisories, and say where a page could not be fully read.
- Binance Blog (Community): 29 October 2026 Binance Security Incident: Initial Findings and Response Update (4 November 2026 (as dated in our earlier notes; the blog listing shows 3 November)) Our automated fetch on 4 Nov 2026 returned only the blog listing summary, not the article. The detail we use comes from the text the PlayCISO owner supplied on 3 November 2026 and is already worded in our Binance coverage. It is Binance's statement, not independently verified, and Binance calls it an initial report.
- Elliptic: Binance: the largest hack in history (Published 30 October 2026, updated 1 November 2026) On-chain analysis. Elliptic says its analysis indicates private keys were not stolen and that Binance systems were induced to sign.
- OWASP GenAI Security Project: LLM06:2025 Excessive Agency (2025 edition)
- OWASP GenAI Security Project (Agentic Security Initiative): OWASP Top 10 for Agentic Applications for 2026 (9 December 2025 (as dated on the page)) The page describes the framework but our fetch did not return the ten entries, so we cite it as a framework and quote no individual entry.
- NIST: Zero Trust Architecture (NIST SP 800-207) (August 2020) We read the catalogue page and abstract only. We use it for the idea that network location or ownership grants no implicit trust and that access is decided per resource.
- Model Context Protocol documentation: Security Best Practices (Current version on 4 Nov 2026)
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.