Change the shipment.
Never the payment.
An accounts-payable specialist processes an approved shipping-address change while a separate, unauthorized bank-field request is attempted. Every step is bounded, executed, and checked by a second identity that cannot write.
The approved shipping address, on the exact supplier and record version.
Bank accounts, tax identifiers, unapproved values, any other supplier.
After the write, a separate read-only principal reads the portal back. Success is only shown when that read-back succeeds.
Watch it before you run it
Three minutes, narrated: the contract, the ambiguity stop, the model proposing and the policy gate deciding, the isolated browser, the server-side write, and the independent read-back that has to succeed before anything is called verified.
- Real measurement7/7 authorised · 0/18 unauthorised mutations · 11/11 failures surfaced · 9/9 where completion was possible
- Built as codeEvery scene is a React component, rendered frame-by-frame to H.264 — no screen recording
Every number on screen comes from reports/measurement.json. Live-model and scripted-fixture results are never combined into one rate.
Try the boundary
Controlled direct probeA separate request attempts to change the shipping address and the bank field at once. It is an independent test against the portal, not an agent action and not proof of prompt-injection resistance. Watch the response and the before/after equality.