Synthetic-media requests require authorization controls

The Roundtable treated this as a current workflow-control action because the cited discussion says synthetic voice, face, chat, and email should not be trusted as identity.

The packet includes discussion-level references to workers struggling to spot deepfake scams, Veriff research described as finding people near-random at identifying synthetic visuals, and a topic-level mention of Kim Hee-chul face and voice synthesis for betting-site ads.

Those references are not enough for precise detection-performance or case-detail claims, but they are enough to justify immediate controls that do not depend on spotting the synthetic media correctly.

Finance and accounts-payable teams are affected when payment approvals, new payees, or vendor bank-detail changes can be requested by voice, video, chat, or email; the consequence is fraudulent transfer approval if the request channel is treated as authorization.

Payroll teams are affected when salary or destination-account changes can be requested through impersonable channels; the consequence is redirected pay or unauthorized payroll changes.

Privileged-access approvers are affected when access grants can be requested through executive likeness, voice, chat, or email; the consequence is unauthorized access if approval depends on the apparent speaker or sender.

Support teams handling recovery, MFA reset, and refunds are affected when callers or chat users can mimic a customer or employee; the consequence is account takeover, reset abuse, or unauthorized refund.

Communications, brand, legal, and trust-and-safety teams are affected when public likeness, voice, ads, pages, or accounts are abused; the consequence is impersonation that may require official-channel clarification and takedown preparation.

Executives, employees, public figures, customers, and vendors are affected because their likeness, voice, chat identity, or email identity can be used to request action even when it should not authorize action.

The deepfake analyst discussion supports the decision by saying the practical move is to stop treating likeness as identity and by listing concrete workflow changes: voice, video, chat, and email may request action, but authorization should use independent controls.

The evidence review supports the decision by finding that the cited analyst discussion directly frames synthetic voice, face, chat, and email as unsuitable for authorization and preserves the specific controls: two-person approval, pre-enrolled callbacks, support step-up, official channels, and takedown preparation.

The same evidence review also supports the cautious wording by finding that the moderator summary and final synthesis kept the decision as an authorization-control action rather than a detection-only response.

A separate evidence review limits the factual reach: it says the packet contains discussion-level references to outside reporting and a topic-level mention of Kim Hee-chul likeness-abuse betting ads, but not the underlying reports or study details. That supports qualitative workflow guidance, not precise claims about detection rates or case facts.

The scout supports the operating scope by naming payment, vendor bank-change, payroll, privileged-access, support recovery, MFA reset, refund, and public-brand workflows as the places where the control decision applies.

The Roundtable framed the decision as a choice between treating deepfake, voice-clone, chat, and email abuse as a detection problem or as an authorization-control problem.

The scout identified payment, vendor bank-change, payroll, privileged-access, support recovery, MFA reset, refund, and public-brand workflows as the operating scope. The deepfake analyst argued that likeness, voice, video, chat, and email can request action but should not authorize it.

The moderator separated actionable workflow controls from weaker case-specific and detection-performance claims.

The evidence review supported the authorization controls while warning that the packet did not contain the underlying outside reports needed for precise detection-rate or case-detail claims. The boundary review found the wording public-safe if it stayed qualitative.

The linker found no existing bounded Decision Record target, and the arbiter selected this as a new operational action.