Until the agent decides that it's more efficient to fake an approval, and carries on...

That's why you literally put it behind authentication?