No Approval Event: The Georgia Voter-Data Story and the Missing Geometry of Agent Authorization

In every audit I have run since 2017, the most damning artifact is never the exploit. It is the empty field. The Georgia voter-data story, as it currently circulates, is six empty fields stacked into a headline. No timestamp. No first-party source — the item is annotated, in its own text, source: none. No product surface: API, Computer Use, browser extension, MCP connector, all undisclosed. No record count, no batch-versus-single distinction. No vendor response. No author, no link. Seven claims, six absences. I am not going to tell you what happened. I cannot. What I can do is dissect the structure, because the structure is the part that repeats. Security is the absence of assumptions, and this story is built entirely of them. Start with the fact that Georgia voter registration data is not secret. The Secretary of State has sold the statewide voter file for years, at a published price, to anyone who completes the form. My Voter Page exists as a per-person lookup portal. Campaigns, consultants, and academic researchers purchase the file routinely. Under federal precedent — hiQ v. LinkedIn, and the narrowed reading of Van Buren — scraping public records carries very low federal criminal exposure. So the legal question here is not access. It is automation. Those are two different compliance surfaces, and nearly every careless write-up collapses them. Access is governed by statute and contract. Automation is governed by terms of service, rate limits, and increasingly by whether a machine acted without a human in the loop. The regulatory trigger, if one exists, sits on the second surface. The first surface was probably never violated. Which means the headline is not a crime story. It is a norm story — and norm stories do not produce enforcement actions, they produce procurement questionnaires. Elections add an asymmetry that ordinary scraping disputes do not carry. Any automation touching voter rolls gets evaluated against a zero-tolerance standard, because the perceived failure mode is not privacy damage but electoral interference. That political framing inflates a procedural defect into a governance crisis, and it explains why state IT offices answer with preventive hardening rather than proportionality. There are four technical paths by which the claim could be literally true, and they assign liability to four different parties. Path A: the deployment had no human-in-the-loop at the API layer. A customer built a pipeline, disabled approvals, and pointed it at a dataset they had lawfully purchased. Vendor responsibility approaches zero. Path B: the agent product shipped a default that let it run. If a permissions-bypass mode is on by default, or a browser extension holds a standing site grant, this is a default-value failure — the oldest failure class in security engineering. Path C: prompt injection. A page the agent read contained instructions, and the agent obeyed. Every major lab concedes this surface is unsolved. It is an industry condition, not a vendor defect. Path D: a vision-action loop misread a page element as an authorized target. A capability boundary, not a permissions bug. Same sentence. Four verdicts. The write-up under discussion answers none of them, which is how I know the author held no primary artifact. Now the deeper problem, and the one worth the ink. No human sign-off is not a technical state. It is a spectrum. Per-call confirmation, a prompt before every tool invocation. Session-level grant, one approval and the rest of the run goes free. Domain whitelist, permanent standing consent for a host. The risk differential across those three is enormous, and the headline compresses them into one phrase. And here is what nobody selling governance wants to hear: per-call confirmation fails at scale. A single agent task invokes tools dozens of times. Users under prompt fatigue approve reflexively within a few cycles. The dialog becomes a rubber stamp — functionally identical to no confirmation at all, except now it emits an audit log asserting a human approved. That is worse than absence. That is manufactured consent with a timestamp. The missing primitive is risk-graded authorization: confirmation strength that scales with target domain sensitivity, data classification, and action reversibility. Government domains, medical records, financial rails, high friction. Read-only, low-sensitivity, idempotent, low friction. No major agent product ships that as a first-class policy layer. They ship a binary switch. The maturity mismatch is measurable. Agent capability is in production; it completes real tasks against real systems. The governance control plane is still proof-of-concept: no standard audit-log schema, no cross-session permission inheritance rules, no third-party-verifiable action credentials. Nobody can prove to a regulator what the agent did, under whose authority, and where the data went. That is the admission requirement for every government deployment, and it does not exist. Precedent says how this resolves. Cloudflare began blocking AI crawlers by default in 2025. Reddit tightened its API. Newsrooms deployed paid-crawl licensing. The template is set: the content holder locks the door unilaterally and the burden shifts to whoever was automating. Government sites own the same tools with stronger justification — low-budget, peak-load-fragile architectures that an agent's polling loop pressures far beyond human traffic. I have seen this failure shape before, in a different costume. When I pulled apart Curve's veCRV governance in 2020, the contract logic was clean. The incentive geometry was not. Voting weight concentrated, reward allocation followed the concentration, and the community-driven label survived intact because the mechanism was auditable and the outcome was not. The code does not lie, but it often omits. EigenLayer restaking gave me the same silhouette in 2024: duplicate signatures across operator sets, slashing conditions ambiguous at the boundary, authorization technically present and semantically undefined. I flagged it, the ecosystem called it FUD, and the ambiguity is still there. Agent authorization is the same class of problem. We built systems that can express do this. We have not built systems that can express this action requires this approver at this risk tier, and here is the verifiable receipt. Zero trust is not a policy; it is a geometry — and the current geometry of agent permissions is one bit. Here is where the bulls are right, and where I part company with most of my peers. First: silence is probably the correct corporate play. No first-party source, no identified victim, no enforcement pathway. A statement amplifies a claim that cannot be verified, and silence gets read as concession only by people who intended to read it that way regardless. Second: the most probable reality is that this was not an incident. A researcher or reporter lawfully purchases the statewide file, feeds it to an agent for processing, and the missing sign-off refers to a processing step. News value near zero. Compliance defect minor. That possibility deserved airtime and received none. Third, and the part the crypto press will not print: the real casualty is not the vendor. It is public-records access. When state election offices decide agents are a threat, they harden — CAPTCHA, rate limits, user-agent blocks, revised terms. The first losers are investigative reporters, voting-rights researchers, civic technologists. And the commercial data brokers, who already hold copies of the file, inherit the moat. Tightening access to public records entrenches private data monopoly. That externality is not being priced by anyone in this conversation. So the question is not whether an agent touched a Georgia voter file, or whose name sits on the press release. The question is whether, in 2026, any vendor can hand a regulator a receipt stating what the agent did, under whose authority, at what risk tier, and where the data went afterward. None can. Compiling the truth from fragmented logs is still, mostly, a human job done by hand. That is the finding. Everything else in this story is a headline waiting for a source.