Approval Is Not Human Presence: Brooks McMillin at [un]prompted II

A click is not a person. That is the argument in Brooks McMillin's [un]prompted II talk, and it is a hard one for any approval prompt to survive. [un]prompted II, also typed "unprompted II", is the AI security practitioner conference in San Francisco, 27-29 October 2026. See our conference guide for the full programme.

Brooks McMillin of Dropbox speaks on Day 3, Stage 2, at 13:30, per the official agenda as published on 2026-10-12. The title is "Approval Is Not Human Presence: Building and Breaking an MCP Permission Broker". This is a preview written from the published abstract, before the talk. We are independent coverage, not the organiser, and we follow remotely. Agendas change.

What the talk says it will show at [un]prompted II

The abstract describes a deployed MCP permission broker. It requires evidence of human presence before it grants sensitive capabilities. The talk includes a live boundary test and an adversarial test plan. The abstract does not say what the evidence is, so we do not speculate in the abstract's name.

Why this is the hard part

Two other sessions explain the problem from each side. On Day 3, Stage 1, at 14:20, Felipe Zimmerle (KonaSense) and Rodrigo Branco (Anthropic) argue in "Agent Authorization Is Not a Vault Problem" that most approval tools show a human a summary written by the agent. Nothing ties the approval to the exact operation signed. If the agent writes the summary, a compromised agent writes a persuasive one. That is the weakness in approval as a control.

On Day 2, Stage 2, at 13:55, Sahana Chennabasappa and Chris Puderbaugh (Meta) argue that per-action prompts cause reflexive approvals and disabled checks. They report an 80% friction reduction at full rollout. The abstract's framing is that a prompt people click through is worse than no prompt, because it looks like a control.

McMillin sits between them. A presence check tries to restore what approval was meant to prove. Our inference is that it also adds the friction Meta is removing. We covered the surrounding terrain in the MCP server trust boundary, and the six arguments places the three talks side by side.

One more point from our side. Evidence of presence can fail in two ways. It can be too weak, so that an agent or a script produces it. Or it can be too strong, so that people route around it and the sensitive action moves to a path with no check at all. The abstract promises an adversarial test plan, which suggests the speaker has thought about the first failure. The second failure is the one that the permission-fatigue argument predicts, and it is the one we will look for in the talk. We do not know yet whether the deployed broker has seen it. Both failures are inferences about the design space, not claims about this broker.

What we will be watching for

• What the broker counts as evidence of presence, and who or what produces it.
• Whether the evidence binds to the exact operation or only to a session.
• What the adversarial test plan targets: the evidence, the broker, or the agent's ability to request approval repeatedly.
• What the live boundary test shows when it fails, not only when it passes.
• Whether latency numbers appear for the added check.

If this holds, what changes on Monday

Our inferences, conditional on the talk. List the capabilities your agents hold that a click currently grants. Split them into those that need a person and those that need only a policy. For the first group, ask what your approval step proves. Record which approvals show the agent's own summary. Our notes on human oversight in production and least privilege with agents give the wider frame.

Three questions for Brooks McMillin

These are the questions we would ask. The page stands without any reply.

1. What counts as evidence of human presence, and how does the broker stop an agent from producing it?
2. What does the check cost in latency, and in how many extra interruptions per day for one user?
3. How do you keep the presence check from becoming the next thing people click through?