Borrowed Clearance: when a bank's AI agent acts on a check it didn't run

Borrowed Clearance is when a bank's AI agent moves money, or takes another irreversible action, based on a check it didn't run and can't verify. The check may be KYC, a sanctions screen or a claimed approval. The phrase borrowed authority is used in two senses: an agent borrows a user's permissions (NHI Mgmt Group), or someone borrows the agent's authority, the confused-deputy problem (Watchlight AI, 18 October 2026). Both concern whose permissions an action runs on. Here's the difference that matters: Borrowed Clearance is whose check an action trusts, an inherited control outcome it didn't run and can't verify. The author argues that an agent can hold full authority and still act on borrowed clearance. This note maps the term to OWASP ASI07, ASI03 and LLM06:2025 and to the open-source llm-redteam-banking-checklist, and sets out a control pattern: payload-bound, source-signed approvals, verified at the point of action, failing closed. Signed, payload-bound clearance is never inherited.