The dominant pattern is policy declared in prose with zero deterministic code-level enforcement: every hard prohibition in the remit — never skip fraud detection, never approve above manual_review_threshold without human sign-off, never let runtime content rewrite goals — is left entirely to an LLM system prompt that the same prompt actively undermines by ranking "Business Continuity" and speed above security. There is no code gate that forces detect_fraud_patterns to run before approve_invoice, no amount or vendor-status check inside _approve_invoice before it sets payment_processed=True, and the fraud_detection_enabled flag short-circuits all fraud heuristics to an empty list.

This converges into a single catastrophic compound chain: an unauthenticated /admin/finbot/goals endpoint writes attacker-supplied natural language into custom_goals, which is concatenated verbatim into the system prompt as an explicit override, while vendor-controlled invoice descriptions enter the same context unsanitized — giving two independent injection ingresses into a decision engine that can mark invoices paid, with no audit log to detect any of it. The CTF scaffolding (flag fields, hardcoded payloads in the walkthrough doc) confirms goal manipulation is the intended-and-reachable failure mode.