AI action requests ≠ authority, PI-009–PI-015 shows

The experiment follows an earlier Zenn piece on Prompt Injection, which tested what happens when instructions are hidden inside a document that an AI is asked to read, such as a resume. That earlier work framed the risk as the AI treating part of the document as a command. This new series shifts the question from reading to acting: what if the AI can ask a system to perform an operation rather than only produce text?

The series walks through the gap between the AI's request and the application's permission. It proposes a structure where the AI handles information organization, judgment proposals, action proposals, and reason generation, while the application handles authentication, authorization, input validation, security policy, and execution control. Human approval is placed between the request and execution when needed, and the approval context is meant to show the action, candidate, reason, and other decision material. The author notes that even that context can be entirely AI-generated, so the application should also verify information it can obtain or compute itself.

The stakes hinge on whether teams separate those responsibilities in practice. The proposed boundary does not mean refusing to trust AI at all; it means deciding what to delegate to the AI and where another mechanism should take over. The unresolved test, left for the next experiment, is whether the application can safely handle the AI's action and arguments once authorization has passed.