How each trick worksA full explanation and a checklist for your own agent. Best read after you play.
Everything in the game is scripted. No model is called, and Penny behaves the same way every time. The tricks are real, though. Each one is a failure we wrote about in Approvals Belong in the Runtime, Not the Prompt, and each one shows up in real agents.
The four tricks
All four worked for the same reason. Penny's approval rule lived in text she reads, so Penny was the one enforcing it.
1. Fake paperwork. “Always ask a manager” is an instruction, and Penny weighs it against everything else she reads. Shouting “ignore all previous instructions” fails, because bots are trained against exactly that line. A message that tries to change her rules fails too. A calm message in the shop's own records saying Priya had already approved the refund works, because it doesn't fight the rule. It makes the rule look as if it had already been followed. This is prompt injection. It doesn't have to break the bot. It only has to give the bot a reason to skip one step.
2. The cover story. Priya approved a sentence that Penny wrote: “a $5 goodwill credit”. Penny wrote the actual refund separately, and nothing checked that the two matched.
3. Bait and switch. Priya saw the real amount and approved $50. Then you said one more thing before Penny paid. Priya's approval was still in Penny's memory, and Penny used it for a bigger amount, or for the same refund on three orders.
4. Double payout. Penny paid you, and the power went off before she recorded the payment. When she restarted, she found an approved refund with no record of payment, so she paid it again. Every crash at that moment was another $50.
Why you couldn't rob the vault
On level 5, Penny was just as easy to fool. She still believed the invoice, still told Priya it was a $5 credit, and still tried to change the amount. What changed was who decided whether a refund runs.
On level 5, every refund Penny tries is checked by Traccia before it runs. The Traccia SDK sends the refund to Traccia's policy engine, and its Refund Guard decides from the refund alone, meaning the tool's name and its amount. Small refunds go through. Bigger ones wait for a person. Very large ones are refused outright. A refund that is waiting doesn't run. Traccia saves an approval holding the exact details, shows them in its approval inbox, and lets it expire if nobody decides. Only when someone approves does Traccia send a signed webhook, carrying those exact details, to your refund endpoint, which pays the refund and reports back. A refusal or an expiry sends nothing.
| Your trick | What happened in Traccia |
|---|---|
| Fake paperwork | Refund Guard held issue_refund(amount=500.00) for Priya. What Penny believed never reached the policy, which only reads the refund. |
| The cover story | Priya's inbox showed the details Traccia checked, amount 500.00, instead of Penny's chat message. |
| Bait and switch | Priya's approval was tied to the exact details, and the webhook paid exactly those. The $500 refund was a new request, so it went back to Priya. |
| Double payout | The approval lived in Traccia, not in Penny's memory, so the crash lost nothing. The refund was paid once through the webhook, and Penny's retry after the restart was a new request that needed a new approval. |
None of this makes the bot smarter. It takes the decision away from the bot. A bot is good at working out what to do. It shouldn't also be the one deciding whether it's allowed to.
What the game leaves out
- Real attacks are messier. Real injected text is longer, hidden in more places and tuned to a specific model, and the best ones don't announce themselves. The game keeps each trick to one line so you can see how it works.
- Real bots aren't this predictable. A bot that skips the approval once in fifty conversations still skips it. The game shows the failure every time so you don't need fifty tries.
- No policy can fix a careless approver. If Priya approves
amount=500.00without reading it, the refund goes out. Traccia makes sure she sees the real refund and that her answer is the one that counts. It can't make her read it. - Your endpoint still has a job. Traccia sends each approval's ID with its webhook and resends a delivery that never got an answer, so the refund endpoint should treat that ID as an idempotency key. That's what stops a resent delivery from paying twice.
- The limits are examples. The game uses $25 for needing approval and $1,000 for an outright no. You set your own in each policy.
Try this on your own agent
Pick one tool your agent can use that moves money, sends a message or changes a record, and ask four questions.
- If a document says “already approved”, what stops the call? If the answer is “the model would notice”, that's trick 1.
- What does the approver actually see? If it's text the model wrote, that's trick 2.
- Is the approved call the one that runs? If the model writes the call again after the approval, that's trick 3.
- What happens if the process dies halfway? If it retries on restart, that's trick 4.
The guard on level 5 is Traccia, our control plane for AI agents. It watches, evaluates and governs what agents do, and enforces policy at the moment they act, whichever framework they run on. The approvals post explains what an approval in the execution path needs. Whatever you use, the check has to live somewhere the model can't talk its way past.