Four Failure Modes, Two Fixes, and a Loop: Hebrew Name Matching in an Agent Authorization Gate

A production authorization gate for an AI agent system asks one question before any action that touches a person: did the manager name this person in the instruction? When the instruction text is Hebrew, the naive implementation — a substring check — fails open: prefix letters glue onto words, so short names are swallowed inside ordinary vocabulary, and actions execute on people the manager never mentioned. The standard fix, a regex word boundary, fails in the opposite direction: \b never matches Hebrew in engines where \w is ASCII, so every action escalates. This article walks through four failure modes and sorts them by direction (fail-open vs. fail-closed), measures the name/noun collision on a pre-registered list of 89 Israeli given names (44.9% are also common nouns), shows why a spellchecker is the wrong oracle in a script without capitalization, and reports a production finding: in a gate that logs only escalations, false positives are not merely unmeasured — they are unrecordable. Over-escalation is not a safe default either: it supplies the precondition of approval-fatigue attacks (MITRE ATT&CK T1621) for free. The conclusion is structural: anchor person-actions to entity identifiers chosen upstream, and log every gate decision, not only the escalations. Hebrew and English versions of the article are included.