A chat message saying Approved is not a security gate, because indirect prompt injection can inject "yes". Automation bias rubber-stamps the proposal, and Time-of-Check to Time-of-Use (TOCTOU) lets $100 to Supplier A become $100,000 to Supplier B.