Interrupt the Paths

A defensible system is often strongest at its chokepoint, where one well-chosen control can interrupt multiple attack paths at once. In this concept, qualified paths from prompt-to-tool, retrieval-to-action, and delegated authority all converge on a shared weakness: overbroad consequential authority. The selected control constrains authority and requires approval at the point where actions become impactful, breaking the chain before misuse can propagate. The result is not perfect elimination of risk, but a meaningful reduction: one path is blocked, another is blocked, and a third is narrowed rather than removed. Because attackers adapt, the control must be retested to confirm it still holds across plausible routes.