When “Do Not” Is Not Deny: AI Authorization Controls and the Rupiah Confidence Perimeter

Rupiah Stability Watch · 2026-08-25

The premise

Rupiah confidence is not only a question of reserves, interest-rate differentials, or the visible exchange rate. It is also a question of whether the operating systems around Indonesian finance can be trusted when pressure rises.

Rupiah Stability Watch has been building that perimeter in several prior pieces: “Agentic AI Operational Risk and the Rupiah: When Autonomous Systems Enter the Financial-Stability Perimeter,” “Evidence Chains and the Rupiah: AI Forecasting, Provenance, and Financial-Stability Confidence,” “Dual-Use AI and the Rupiah: Verification, Autonomous Force, and Indonesia’s Confidence Premium,” “Post-Quantum Migration and the Rupiah: Cybersecurity as a Financial-Stability Channel,” and the August 24 weekly monitor, “Stability Is Now an Operating Ledger.” Together, those pieces made a simple point: AI becomes rupiah-relevant not because it is fashionable, but when it touches payments, settlement, market communication, procurement, logistics, energy, cyber response, or public warning.

A fresh AI-trust signal makes that perimeter more concrete. Ting Yan’s arXiv paper, “When ‘Do Not’ Is Not Deny: Security Rules in CLAUDE.md vs Built-In Controls”, examines the gap between natural-language security rules and enforceable controls in AI coding-agent environments. The finding is narrow, but the lesson is wider. In 481 public CLAUDE.md files, only about 4–16% of retrieved security rules had a matching built-in control, depending on the match standard. Under the strictest standard, the estimate was 4.4%, with a 95% confidence interval of 2.6–6.7%. The paper describes CLAUDE.md as a “write-only channel”: a developer can write a security rule, but receives no reliable feedback that the rule will be enforced.

For the rupiah, the question is not whether an AI system sounds obedient; it is whether the systems around it can prevent an unauthorized action before confidence has to absorb the mistake.

What the evidence supports

The paper’s direct subject is software development practice, not Indonesian finance. It does not say that Indonesian payment systems are unsafe. It does not say that AI agents have already affected USD/IDR. Its useful contribution is more precise: it separates a written instruction from an enforceable permission boundary.

That distinction matters once agents are coupled to tools. A model can be told “do not approve this payment,” “do not alter production data,” “ask before sending this market update,” or “never touch this vendor account.” Those sentences may guide behavior. They are not, by themselves, controls. A control is something the surrounding system enforces before the action occurs: a deny rule, sandbox, approval gate, credential boundary, transaction limit, revocation path, or runtime monitor.

Indonesia already has a regulatory anchor for this direction. Bank Indonesia’s Regulation Number 2 of 2024 covers information-system security and cyber resilience for payment system providers, money-market and foreign-exchange market participants, and other parties regulated and supervised by BI. The title alone matters for this analysis because it places payment, money-market, and FX-market participants inside one cyber-resilience frame. That is close to the rupiah confidence perimeter.

OJK has also moved into AI governance for banking. Its Artificial Intelligence Governance for Indonesian Banks, launched in April 2025, is described by OJK as guidance for responsible AI development and implementation across the banking lifecycle. OJK’s separate financial-sector release also refers to cybersecurity work for digital asset traders and ITSK reporting under OJK Regulation Number 3 of 2024, showing that AI, cyber resilience, and digital financial operators are no longer separable supervisory topics.

Bank Indonesia’s payment-infrastructure work gives the operational context. The Indonesia Payment System Blueprint 2030 is framed around a resilient payment system within a consolidative structure. BI describes BI-FAST as payment-system infrastructure provided by Bank Indonesia and accessed through industry applications to facilitate retail transactions. BI describes QRIS as a standard developed with the payment-system industry so QR transactions are faster, easier, cheaper, secure, and reliable.

These are not abstract rails. They are part of the daily confidence surface. If an AI-enabled operator assists a bank, payment provider, vendor, logistics platform, public procurement system, port system, or energy scheduler, then the relevant control question is no longer only “was the advice accurate?” It is “what was the agent allowed to do, under whose authority, with what logs, and how quickly could that authority be revoked?”

Four things that should not be confused

First, advice quality is not authorization. An AI model may summarize a regulation well and still be unsafe if it can initiate an irreversible action without a hard permission boundary.

Second, evidence-chain trust is not authorization. A model may cite its sources and still have excessive access to tools. Evidence chains help people understand why a claim was made. Authorization controls decide whether an action can happen.

Third, written rules are not tool controls. A prompt saying “do not send external messages during an incident” is weaker than a system that disables external-send permissions unless a named human approves.

Fourth, an authorization weakness is not automatically a currency shock. It becomes rupiah-relevant through transmission channels: operational disruption, fraud, loss of payment confidence, incident opacity, vendor concentration, foreign-exchange settlement stress, or a visible public-sector failure that changes expectations. This piece is about those channels, not about predicting today’s exchange rate.

Where the rupiah transmission could occur

The first channel is payment continuity. BI-FAST, QRIS, bank apps, switching services, merchant acquirers, e-wallets, and reconciliation systems depend on ordinary users believing that a payment will clear, reverse when appropriate, and leave a usable record. If AI agents are added to fraud handling, customer service, exception processing, or operational triage, weak permissions could turn a small error into a wider confidence event. A helpful assistant should not be able to change payment limits, approve a refund batch, suppress alerts, alter logs, or message customers unless that authority is explicit and bounded.

The second channel is money-market and FX-market operations. Bank Indonesia’s Regulation 2/2024 explicitly touches money-market and foreign-exchange market participants. In those environments, speed and clarity matter. A mistaken instruction, unauthorized data change, or premature external communication during a cyber incident can force human teams to spend scarce time reconstructing what happened. In a stressed market, uncertainty itself becomes costly.

The third channel is public procurement and operating disclosure. Recent Rupiah Stability Watch work on operating ledgers, including MBG-related disclosure, has treated procurement and public-service continuity as part of currency confidence. AI systems may be used to reconcile vendor invoices, flag anomalies, draft public updates, allocate kitchen or logistics resources, or summarize compliance status. The control issue is whether such systems can only recommend, or whether they can alter ledgers, approve vendors, publish notices, or move funds.

The fourth channel is port, energy, and logistics coordination. Indonesia’s import exposure makes logistics confidence part of currency resilience. A tool-using agent in a port, fuel, food, power, or shipping workflow may be useful for scheduling and anomaly detection. But if the agent has broad write permissions, a prompt-level “do not disrupt operations” rule is not enough. Least privilege matters because the rupiah channel may appear through delays, demurrage, inventory stress, fuel costs, or public concern about essential goods.

The fifth channel is market communication during incidents. A poor AI answer is one kind of failure. An unauthorized public statement is another. If an agent can send notices, update dashboards, contact counterparties, or draft official explanations without enforced approval thresholds, then the problem is not language quality alone. It is institutional voice control.

The sixth channel is third-party concentration. If many financial or public operators rely on the same AI platform, same cloud account, same managed-service provider, or same identity layer, then one permission-model weakness can become a shared exposure. The immediate harm may be operational. The second-order harm is that no one can tell quickly who else is affected.

The least-harm control checklist

A cautious path does not require rejecting AI agents. It requires treating them as actors inside an authorization system, not as advice boxes floating above it.

1. Deny by default. New AI agents should begin with no production write access, no external-send authority, and no transaction authority unless explicitly granted.

2. Use least privilege. Permissions should be narrow by tool, account, function, data class, transaction size, and operating environment. A reconciliation assistant does not need payment-release authority.

3. Separate advice from irreversible action. Forecasting, summarizing, drafting, and anomaly detection should be treated differently from approving, moving funds, changing limits, publishing notices, or altering records.

4. Set human confirmation thresholds. Human approval should be required for irreversible actions, public communications, cross-institution messages, large exceptions, and any action during a declared incident mode.

5. Make logs audit-ready. Logs should show who delegated authority, what the agent requested, what tool was called, what data was touched, what approval occurred, and what result followed. They should be protected from the agent they record.

6. Build revocation and kill switches. Operators should be able to suspend an agent, revoke a credential, freeze a tool, or revert to manual mode without negotiating with the model.

7. Preserve fallback operations. Payment, market, logistics, energy, and public-service systems need tested manual or degraded-mode procedures. Fallbacks are not old-fashioned; they are confidence infrastructure.

8. Map third-party dependencies. Banks, payment providers, public agencies, ports, and critical vendors should know which AI, cloud, identity, and data providers sit inside operational flows.

9. Monitor runtime behavior. Permission checks should happen at action time, not only at design time. An agent that stays inside scope for weeks can still attempt an out-of-scope action tomorrow.

10. Communicate incidents plainly. If an AI-linked incident affects users, counterparties, or public services, communication should distinguish what happened, what did not happen, what is contained, what is still unknown, and what fallback is operating.

What this does not prove

This evidence does not prove that Indonesian financial infrastructure is exposed in the same way as public CLAUDE.md files. It does not measure Bank Indonesia, OJK, banks, payment providers, ports, or public agencies. It also does not show a direct rupiah-market effect.

The paper’s narrowness is part of its value. It gives a measurable example of a broader design problem: natural-language prohibitions can look like controls while leaving the actual permission boundary unchanged. That is enough to justify a supervisory question wherever AI agents gain access to consequential tools.

The practical standard is simple. If an AI system can touch a rupiah-relevant workflow, it should be possible to answer: what can it do, what can it not do, who allowed that, where is the proof, and how fast can the permission be taken away?

A system that can answer those questions reduces the burden placed on public trust. A system that cannot answer them asks the rupiah confidence perimeter to carry risks that should have been stopped at the authorization layer.