When is an AI agent's approval prompt a security boundary?