The Human-in-the-Loop Approval Step in Most Agentic Workflows Is Broken

Most human-in-the-loop implementations share the same flaw, the server trusts the client to tell it what tool is being approved. Here's why it's exploitable and how to fix it.