Three Fraud Surfaces for AI Agents

The established Cressey fraud triangle describes pressure, opportunity, and rationalization. Identity, execution, and cashout are different. They are 3 operational surfaces that help an investigator trace an agent-enabled scheme.

The lens is deliberately practical: who or what acted, which environment and tool path executed the action, and where value or benefit moved. Some schemes will involve all 3. Others may create harm without a financial cashout, so the model should guide questions rather than claim universal coverage.

Surface 1: Identity and Authority

The first surface asks which principal, agent, credential, and wallet are involved. A valid credential can still be stolen, replayed, over-delegated, or used outside its intended scope.

The useful control separates identity from authority. Identify the agent and principal, then verify the current action, amount, counterparty, purpose, and time window. Missing evidence should remain missing rather than being converted into a clean result.

Surface 2: Execution

Execution covers the runtime, session, network, tools, model instructions, and enforcement point that turn authority into action. An API-native agent may produce fewer human behavioral signals while producing richer workload, credential, tool-version, and invocation evidence.

Controls should bind an approved exact-version tool to the assigned agent and current policy. A changed digest needs reassessment. A signed invocation decision remains separate from evidence that the call executed successfully.

Surface 3: Cashout and Benefit

Cashout asks where value, access, data, compute, inventory, or another benefit ended up. A completed stablecoin transfer is one possible outcome. So is a fulfilled API response, exported credential, reservation, refund, or account change.

Monitoring should connect the destination and outcome to the principal, agent, wallet, counterparty, declared purpose, and authority that applied at the decision. Small transactions can require aggregation, but many small payments are not automatically suspicious or structuring.

Controls That Span the 3 Surfaces

Human fraud controls remain useful where their signals exist. Agent-aware controls add workload and agent identity, delegated scope, exact-version tool approval, runtime evidence, wallet provenance, velocity, counterparty context, and linked outcomes.

Enforcement belongs at the consequential boundary: before the wallet signs, the API releases value, the merchant fulfills, or the tool executes. Rate limits and least privilege reduce maximum loss when other evidence is incomplete.

What a Signed Record Contributes

A signed verification record preserves the evidence FLINT evaluated, the rules version, reason codes, and decision. Its signature identifies the issuer and reveals post-issuance changes to the signed bytes.

The record does not prove every input was true, force the caller to enforce the verdict, show that a tool executed, establish that payment settled, or shift liability. Those facts require separate controls and linked outcome records.

Questions for a Fraud Review

• Identity and authority. Which principal, agent, credential, wallet, and mandate were in force?
• Execution. Which runtime, tool digest, arguments, policy, and enforcement point produced the action?
• Cashout or benefit. Where did money, data, access, inventory, or another benefit move, and what outcome was observed?
• Evidence quality. Which facts are independently verified, which are asserted, and which remain unavailable?

Related Academy Briefs

• Agentic Fraud in 2026
• A Valid Agent Can Still Use the Wrong Tool