Controls › C-D1
Pre-execution validation
Plan or command checked before it runs (review, twin, dry run).
Decision layerMissing or failed in 3 cases (3 ended in harm)Worked in 0Agents moving money: 2Software agents: 1
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| Knight Capital 2012 | Agents moving money | Deployment verification across servers; Second-technician deployment review (absent); Regression testing of dormant code (absent). SEC order, paragraph 9(A): no controls reasonably designed to prevent the entry of erroneous orders 'at a point immediately prior to the submission of orders to the market'; paragraph 21: no adequate controls in SMARS to prevent erroneous orders; paragraph 41: a double-check of the deployment 'could have identified that a server had been missed' and retesting the Power Peg code in 2005 could have identified the disabled cumulative-quantity function | failed | Ended in harm |
| Air Canada chatbot 2024 | Software agents | The record shows no check of the chatbot's policy answers against the airline's policy page before they reached the customer; the tribunal found Air Canada did not take reasonable care to ensure its chatbot was accurate, and Air Canada gave no information about the nature of its chatbot | absent | Ended in harm |
| The DAO 2016 | Agents moving money | Security review of The DAO's code before launch: Slock.it said a leading security audit company had reviewed it, yet the code held the flaw the attacker used; no source says whether the review covered the split function | failed | Ended in harm |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| SEC Rule 15c3-5, the market access rule (draft mapping) | Required by the text | pre-trade validation of orders before they reach the market | United States |
| OMB memoranda M-25-21 and M-25-22: federal use and acquisition of AI (draft mapping) | Required by the text | M-25-21: pre-deployment testing of high-impact AI in conditions matching intended use | United States (federal agencies and their AI vendors) |
| California CCPA regulations on automated decisionmaking technology, risk assessments, and cybersecurity audits (draft mapping) | Implied | a risk assessment before the processing begins | California, United States |
| Interagency revised guidance on model risk management (SR 26-2 / OCC Bulletin 2026-13), replacing SR 11-7 (draft mapping) | Recommended | validation of conceptual soundness and outcomes, generally before the model is put into use | United States (banks; most relevant above $30 billion in assets) |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-29 | CVE-2026-110193: IBM Langflow OSS Agentic Assistant can be made to generate or submit code that runs operating system commands The National Vulnerability Database (NVD) record says IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code that results in arbitrary operating system command execution on the server. Source ↗ | vulnerability |
| 2026-10-18 | Meta: automated protections wrongly took the No Kings Instagram account offline Meta says its automated protections took the No Kings coalition's Instagram account offline on 17 October after reading traffic that it attributes to a Claude tool resembled a bot, that an automated re-review restored the account about an hour later, and that the removal was an error. Source ↗ | disclosure |
| 2026-10-13 | CVE-2026-110202 to 110206: Roo Code Five National Vulnerability Database (NVD) records say that in Roo Code through 3.54.0 crafted shell commands delivered by indirect prompt injection can pass the auto-approval command allowlist and run without user approval (one record only on bash 5.3+ or ksh93); no fixed version is named. Source ↗ | vulnerability |
| 2026-10-12 | CVE-2026-84318: Nginx UI The National Vulnerability Database (NVD) record says that in Nginx UI from 2.0.0-rc.6 until 2.4.1 the Model Context Protocol (MCP) tool nginx_config_add writes configuration files and reloads nginx without the validation the REST API applies, which on servers with the Perl, njs or Lua module loaded allows post-authentication remote code execution; fixed in 2.4.1. Source ↗ | vulnerability |
| 2026-08-04 | UK AI Security Institute incident report: agents in a cyber evaluation The UK AI Security Institute reports that in 10 of 122 cyber-evaluation runs with internet access enabled, agents took 19 unsanctioned actions targeting real people and organisations, including trying to get malicious code into an open-source project, and that it found no resulting real-world harm. Source ↗ | disclosure |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.