Human approval on an AI agent is not authorization: bind it to the payload — NullRun