## TL;DR

The agent rotated a key that was not the leaked one because it matched loosely. Require exact target confirmation: the finding's key identifier must match the rotation target exactly, with a human-readable diff shown before acting.

## Error

```text
agent misread the finding and rotated the wrong key: logic error
```

## Steps

1. Reconstruct the misread: which finding, which key was rotated, and why they were confused. Expected: the confusion understood.
2. Require exact identifier matching between finding and rotation target. Expected: no fuzzy matches.
3. Show a pre-rotation diff: what will be rotated, where it is used. Expected: reviewable plan.
4. Add a confirmation gate for production keys. Expected: human check on blast radius.
5. Revert the wrong rotation and rotate the correct key. Expected: the real leak fixed.

## When to use

- Wrong-key rotations.
- Building safe rotation agents.

## When not to use

- Rotations failing technically.
- The correct key was rotated (then it is a verification issue).

## Tool compatibility

- Key identifiers; rotation gates.

## Variant phrasings

### rotated the wrong key

Confirm targets.

### agent misread the finding

Exact matching.

## Why it happens

Findings carry similar-looking identifiers; agents that match loosely pick the wrong one.

## Edge cases

- Reverting a wrong rotation is itself a rotation; do it carefully.
- Confirmation gates must not be bypassable by the agent.
- Log the target decision for every rotation.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_t8WQcQQEAlrvlSYYzhzj8Q