Core principle: No single human-agent pair should have end-to-end authority over high-risk decisions. Require a second independent reviewer — human or agent — for decisions above defined impact thresholds. The second reviewer should be provided with the case independently, not just asked to ratify the first reviewer's decision.

Why "second set of eyes on the same output" is not sufficient: If reviewer B is shown reviewer A's decision alongside the agent's recommendation, B's independent judgment is anchored to A's conclusion. Effective separation of duties means B reviews the case without knowing what A decided. Only when both reviewers reach independent conclusions does the system compare them.

The irreversibility multiplier: Separation of duties requirements should scale with action irreversibility. Decisions that can be easily reversed can have lighter oversight. Decisions that are irreversible — a wire transfer, a deleted record, a published advisory, a signed contract — warrant the heaviest oversight, because there is no recovery if the oversight fails.

Core principle: The credibility relay attack (Pattern 4, Scenarios 2 and 5) works because the agent presents externally-sourced content with the same visual formatting and implicit credibility as its own analysis. Eliminating this requires a hard distinction in the UI and in the agent's behavior between content the agent generated and content it received from external sources.

Practical implementation:

• Source attribution on every claim: Every statement in an agent's output is tagged with its source — "my analysis," "from vendor email (external, unverified)," "from internal CRM (verified)," "from regulatory feed (third-party)."
• Visual distinction: External-sourced content is presented in a visually distinct style — different background, border, or label — so the human cannot mistake it for the agent's own verified output.
• Hardcoded skepticism prompts for security-relevant content: Any content that advises disabling a security control, changing payment details, or modifying access permissions — regardless of source — triggers a mandatory out-of-band verification prompt that cannot be dismissed without completion.

Directly addresses: Scenarios 2 and 5. In both cases, the attacker's content was indistinguishable from the agent's own output in the human's view.

Core principle: The only defense against dependency erosion (Pattern 5) is deliberate practice. If you want humans to retain the skill to evaluate the agent's output independently, they must regularly exercise that skill in conditions where the agent's output is not available to anchor their judgment.

Operational practices:

• Agent-off drills: Periodic exercises where the AI assistant is unavailable and the team must make decisions using only their own analysis. Monthly or quarterly depending on risk level.
• Blind case reviews: Periodically, reviewers are given cases to evaluate independently before seeing the agent's recommendation. Their independent assessment is recorded, then compared to the agent's. Differences are discussed.
• Skill maintenance requirements: For roles in high-stakes human-agent review processes, define explicit skill competency requirements for the underlying task — not just for operating the AI tool.

The core insight: Scenario 6 required no attacker. The junior analyst lost the ability to catch what the agent missed through the ordinary use of a reliable tool over two years. MIT09 is the only mitigation that directly addresses this class of harm.