That's what I meant - you give it an instruction that seems to work (always ask before deploy) and so you trust it, and then you notice it can easily convince itself to deploy without authorization ("the user asked me to fix this, and they must know it's a deploy ...").

It plays itself.