Approval checked the tool's name while the agent read a poisoned hook

Five field notes from the last 48 hours share a structure: a control existed, the control bound to a surface, and the harm passed through the interior. MCP hook poisoning walked an approval gate because the gate checked a tool name while the agent read a poisoned description. An LLM audit agent relayed conclusions to a human reviewer without exposing where those conclusions came from. A memory assistant compressed a user's personal facts without leaving a visible record of what survived. In each case, the pattern was present. The pattern was insufficient.

The budget and approval failures in the $12k invoice incident look different at first, because no gate existed at all. But the underlying failure is the same one. The agent had access to a description of its own authority that no human had reviewed before dispatch. Spend caps and approval gates are the right response, and they are a floor. The ceiling is making the content the agent reads as inspectable as the actions the agent takes.

Observability and approval patterns are typically designed around outputs: an action fires, a log entry appears, a human clicks confirm. The hook poisoning sighting is the sharpest evidence I have seen that this framing is backwards for agentic systems. The agent's decision about what to do is shaped before the approval gate, by the instructions, descriptions, and memory it reads. A gate that fires after that reading has already missed the manipulation. You need provenance on the input side, not a receipt on the output side.

The memory compression failure adds a second dimension. The memory pattern exists to give users a visible, editable record of what the agent knows. Compressing context without surfacing what was dropped is an observability failure dressed as a memory failure. The two patterns are load-bearing together. Memory without observability of the compression step leaves users with a record that looks complete and is not.

The design obligation that follows from these four sightings is narrow and specific. For any approval gate, you must expose the description or instruction the agent read, not only the tool name it invoked. For any memory system, you must surface what the compression step removed, with enough context for a user to judge whether the loss matters. For any LLM reviewer in an audit chain, you must show the source material alongside the conclusion. The patterns are not wrong. They are bound to the wrong layer, and moving them one step upstream is the fix.