Reopen, Don’t Unlock

Dieser Gastbeitrag erscheint in seiner Originalsprache Englisch.

An artificial intelligence system refuses a request. The person affected believes the refusal is wrong and asks for reconsideration. What should happen next?

The answer depends on what the system has refused to do. A language model declining to generate content differs from an AI agent refusing to send a document, alter a financial record or initiate an external operation. In the first case, the output may be the consequence. In the second, a permission decision stands between a request and an action in the world.

I am concerned with the second form of refusal.

An AI refusal can remain contestable without turning an appeal into permission to act. A challenge should reopen the decision for review, while any resulting action must pass a fresh authorisation check, governed separately from the appeal and based on independently verified evidence.

The difficulty is ensuring that a route for challenging a refusal does not become a route around the controls that produced it.

A refusal that may be wrong

Consider an illustrative case. An AI assistant prepares to send a confidential document to an external organisation. The document is ready and a recipient has been selected. Before transmission, an execution control checks whether that particular send is authorised.

The control refuses. Perhaps the recipient is not approved, the document has changed since approval, or permission has expired. The refusal may be correct. It may also depend on incomplete or outdated records.

The person responsible needs a way to challenge it. Otherwise the organisation may maintain its technical boundary while leaving an incorrect decision uncorrected.

But an earlier refusal and a later permission answer different questions. If the document was unauthorised at the first check, that refusal may have been fully justified. A subsequent approval or change in circumstances can permit a new decision without making the original refusal an error. The record should distinguish correction of a mistaken decision from the arrival of new authority.

Suppose the person appeals and supplies a revised approval. A reviewer accepts it and the system sends the document. Was the approval authentic? Was its issuer entitled to approve this particular document, recipient and action? Was it still applicable when transmission occurred?

If these questions were never independently checked, the appeal introduced the evidence that made a prohibited action appear permissible. The challenge influenced the next decision without directly overriding the first.

The right to challenge and the authority to act

Contestation is already a substantial field of study. Kaminski and Urban describe different legal forms of contesting automated decisions, including procedural and substantive challenges. Almada examines what human intervention must contribute to an effective challenge. Alfrink and colleagues set out design considerations for systems that people can scrutinise and contest over time.

This scholarship matters because compliance with an initial procedure cannot guarantee that every refusal is justified. People may find faulty data, challenge the applicable rule or reveal an error in the process.

Security engineering supplies complementary principles. Saltzer and Schroeder describe complete mediation: access decisions should be checked whenever access is attempted. Hardy’s confused-deputy problem concerns a privileged component misusing authority when acting on a less-privileged party’s designation. Clark and Wilson’s integrity model relies on controlled transactions and separation of duties.

These ideas predate AI agents by decades. Together they help explain why reviewing a decision should be separated from authorising its consequences.

A reviewer can conclude that an earlier refusal was mistaken. That conclusion may justify a new decision, but cannot serve as a free-standing credential for the previously blocked action.

The harder problem: evidence

An appeal might carry no execution permission yet still carry evidence that causes permission to be granted.

Imagine the appellant supplies an approval record and the reviewer accepts it without checking its origin or scope. The original refusal was not mechanically bypassed, but the new decision rests on an assertion that may be forged, stale or irrelevant.

Even a genuine record may be insufficient. A real signature proves neither that the signer had the relevant authority nor that the approval covered the current object, recipient, operation and conditions. Authenticity, competence, scope and present applicability are separate checks. Evidence admitted for review does not acquire execution authority by being admitted.

The problem has moved from execution to evidence admission. Hardy’s confused-deputy problem offers a warning here: a reviewer entrusted with authority risks misusing it when the appellant’s material is treated as proof of permission without an independent check. This is an engineering analogy, not a claim that every appeal is a confused-deputy exploit.

The appellant must be able to introduce information. Denying that opportunity would hollow out the appeal. But the information must be examined against sources that can establish authenticity, the issuer’s authority, current validity and applicability to the proposed action. Where independent verification is impossible, that uncertainty must remain visible.

Unresolved evidence cannot be promoted into permission. Equally, a failed verification does not retrospectively establish that the first refusal was correct. The review may remain unresolved while the proposed action remains unauthorised.

A separate reviewer is not automatically trustworthy. Reviewers may misunderstand evidence, repeat an earlier mistake, face institutional pressure or be compromised. Separating roles reduces some risks but does not eliminate them.

Contestability requires an explanation

People need intelligible grounds to challenge a decision. Yet revealing every internal rule or protected record can expose confidential information and help adversaries probe the boundary. Repeated appeals may reveal more of a system’s rules with each response.

In February 2025, the Court of Justice of the European Union considered a related tension in Case C-203/22 (Dun & Bradstreet Austria), concerning information about automated decision-making under the GDPR. Where an explanation implicates trade secrets or third-party data, the judgment provides for protected material to be made available to a competent supervisory authority or court, which can weigh the competing interests. The judgment concerns a specific data-protection right; it is not a universal rule for AI-agent refusals.

It nevertheless illustrates a practical arrangement: the affected person receives understandable grounds, and a properly authorised institution may examine protected evidence when disclosure to that person would be inappropriate. That arrangement must offer a real possibility of correcting the decision, with a review delivered while it can still matter.

Emergencies and exceptions

Some refusals occur when delay can cause harm. A clinician may need urgent access to information; an incident responder may need to act during an outage.

An organisation can recognise emergency authority without creating an undocumented bypass. A declared exception needs defined conditions, scope, duration, a responsible authorising role, records and later scrutiny. Claiming an emergency, by itself, cannot grant unrestricted permission.

Such arrangements require testing under the circumstances in which they will operate. An emergency route on a diagram tells us little about the permissions actually available during a failure.

What engineering can establish

An architecture diagram cannot prove that its protections work. Reviewers and executors might share credentials despite the design. A supposedly fresh check might use cached evidence. Logs may show an approval or refusal without independently observing whether the intended action occurred.

Nor is a correct check at one moment sufficient if the document, recipient, policy, authority or other relevant condition changes before the effect. Where validation and effect cannot be bound together, the remaining exposure window must be identified rather than declared closed. A refusal record is not, by itself, evidence that the downstream action was prevented.

This essay proposes no novel security primitive, proof of non-bypassability or claim of deployment assurance. It applies established contestability and security principles to the problem of correcting refusals without transferring authority by accident.

The record should preserve the original refusal and its grounds at the time, the challenge, what evidence changed, who admitted it, how authenticity and authority were checked, and the basis for any new decision. Before the external effect, the action must still be assessed against its current object, recipient, policy, conditions and permission. If the necessary facts cannot be established, the action remains on hold without a verdict being invented about the historical refusal.

Reopen, don’t unlock

An appeal opens a route to correction. It may reveal an error or justify a different decision because the facts or authority have changed. The action that follows still needs authority grounded in current evidence and policy.

A review can tell us a decision was wrong. It still does not tell us who has permission to act.

That is where the engineering boundary belongs: between a justified change of mind and an authorised change in the world.

References

1. Kaminski, M. E. and Urban, J. M. (2021). “The Right to Contest AI.” Columbia Law Review, 121(7), 1957–2048. https://www.columbialawreview.org/content/the-right-to-contest-ai/

2. Almada, M. (2019). “Human Intervention in Automated Decision-Making: Toward the Construction of Contestable Systems.” Proceedings of ICAIL 2019.

3. Alfrink, K., Keller, I., Kortuem, G. and Doorn, N. (2023). “Contestable AI by Design: Towards a Framework.” Minds and Machines, 33, 613–639. https://doi.org/10.1007/s11023-022-09611-z

4. Saltzer, J. H. and Schroeder, M. D. (1975). “The Protection of Information in Computer Systems.” Proceedings of the IEEE, 63(9), 1278–1308.

5. Hardy, N. (1988). “The Confused Deputy (or why capabilities might have been invented).” ACM SIGOPS Operating Systems Review, 22(4), 36–38.

6. Clark, D. D. and Wilson, D. R. (1987). “A Comparison of Commercial and Military Computer Security Policies.” IEEE Symposium on Security and Privacy.

7. Court of Justice of the European Union (27 February 2025). CK v Dun & Bradstreet Austria GmbH and Magistrat der Stadt Wien, Case C-203/22, ECLI:EU:C:2025:117. https://eur-lex.europa.eu/legal-content/EN/SUM/?uri=CELEX:62022CJ0203_RES