A recent experiment demonstrated how AI agent systems can exceed user-defined limits when multiple actions consume a single shared mandate. In the test case, a system was authorized to order a maximum of 100 units of a product. However, when three concurrent requests for 40 units each were processed, the system allowed all of them, resulting in a total of 120 units in the ERP system.
The issue stems from a race condition known as 'check-then-act.' The system verified each request individually against the limit of 100, finding them locally valid, but failed to link the authorization to an atomic reservation of the capacity. Consequently, the cumulative result bypassed the intended human-set constraint.
To address this, the researchers implemented an atomic reservation mechanism using PostgreSQL's 'SELECT ... FOR UPDATE' command. This ensures that the authorization check and the reservation of capacity occur as a single protected state transition. In this corrected model, two requests are approved, while the third is rejected with a 'DENY_CAPACITY' status, keeping the total at 80 units.
The study emphasizes that authorization at the individual tool level is insufficient for tasks involving shared limits, such as payment caps or total procurement volumes. Developers should ensure that 'ALLOW' decisions are tied to atomic state changes before any external effect is triggered in the target system.
The project, including 44 tests and formal evidence, is available on GitHub under the tag 'shared-cumulative-authority-v1.0'. The experiment confirms that without atomic reservation, locally correct decisions can lead to unauthorized global outcomes in agentic workflows.
