Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents

• URL: http://arxiv.org/abs/2606.22504v1
• Date: Sun, 21 Jun 2026 13:52:37 GMT
• Title: Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents
• Abstract summary: PORTICO is a reference monitor for capabilities exposed to the planner.<n>It compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Coding agents often receive broad tool access for an entire task, even when a resource is needed only for one subgoal. We call this gap lingering authority: a temporary resource/effect capability remains exposed after the episode that justified it has closed. PORTICO is a reference monitor for revocable capabilities exposed to the planner. It compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules. A request-grant-invoke lifecycle materializes expansions as opaque, epoch-bound handles. Closure removes those handles from the next planner interface and rejects stale replay before side effects. The monitor assumes mediated tools and a sound typed catalog. In controlled coding-agent tasks, PORTICO records no executed contract-forbidden effects in the evaluated runs, while controlled grants recover boundary work blocked by a fixed narrow envelope. A non-revoking comparator receives the same initial envelope and the same grants at the same turns. On the closure slice, both systems match task success, scope compliance, and all pre-closure decisions; PORTICO then rejects 10/10 post-closure reuses, while the comparator permits 10/10. A deterministic stale-write audit records 0/6 versus 6/6 executed forbidden effects. Scripted traces and six live model traces over file writes, git mutation, and network egress show the same split. In a four-episode same-policy diagnostic, broad request exposure preserves zero executed forbidden effects but raises blocked proposals from 67 to 84. Frozen real-repository runs, with commits and traces recorded, exercise the same lifecycle on real project layouts.

Related papers

• From Transient Prompts to Persistent Control: Scientific Poster Generation via Recursive Semantic-Geometric Contracts [67.34566880931716]
  PosterVisor is a control framework that shifts poster generation from transient prompts to persistent control.<n>An Orchestrator grounds rubrics in the paper and visual assets, compiling them into a Semantic-Geometric Contract.<n>Recursive Contract Enforcement (RCE) dynamically triggers checks across stages as evidence emerges.
  arXiv  Detail & Related papers  (2026-09-15T15:32:07Z)
• Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound [4.805352087824778]
  ClosureBound binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs.<n>It re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound.<n>A lexical audit of 549 public Skills finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field.
  arXiv  Detail & Related papers  (2026-09-05T06:27:52Z)
• $Z^2$-ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN [43.15181031994434]
  We propose a zero-knowledge auditable control and zero-trust verifiable agentic intent architecture.<n>A live large language model is used in the non-real-time path to translate operator intents into Intent Contracts.<n>Results indicate improved actuation filtering and attack resilience at modest latency and signaling cost.
  arXiv  Detail & Related papers  (2026-08-21T12:44:03Z)
• Claim Plane: Enforceable Change Intents and Dynamic Scope for Parallel Coding Agents [1.4721615285883427]
  This paper presents Claim Plane, a model-agnostic coordination architecture that treats concurrent software change as a pre-write admission problem.<n>A deterministic control plane atomically admits compatible intents, constrains same-file parallelism to declared regions, serializes unresolved overlap, tracks dependency invalidation, and fails closed on ambiguous authority.<n>During execution, a contingent mutation does not reserve write ownership initially; the first attempted mutation triggers atomic scope promotion and re-admission against the current active set.
  arXiv  Detail & Related papers  (2026-07-24T02:30:50Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives [0.0]
  This contract holds on none of six widely used open-source frameworks.<n>Model-free differential probes isolate a recurring sibling leak.<n>SoundGATE is an environment-external Rust gate through which every side effect must be admitted.
  arXiv  Detail & Related papers  (2026-07-15T05:55:38Z)
• Falsifiable Release Gates for Self-Improving Systems [0.0]
  We describe falsifiable release gates, and a methodology to build and validate such systems.<n>Every new capability must pass a pre-specified, machine-verifiable acceptance suite before it ships.<n>No action goes to an effector without a safety-critical property capability token minted by a control ring.
  arXiv  Detail & Related papers  (2026-07-11T06:06:34Z)
• LemonHarness Technical Report [40.68992799867636]
  LemonHarness is an integrated execution framework for long-horizon agents.<n>It constrains state-changing operations within a clearly defined workspace.<n>It brings model invocation, tool execution, and rule knowledge within a single controlled boundary.
  arXiv  Detail & Related papers  (2026-06-23T08:44:00Z)
• Cordon: Semantic Transactions for Tool-Using LLM Agents [11.567293065381918]
  This paper introduces Cordon, a transactional runtime system for staging and validating agent effects before commit.<n>It reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.
  arXiv  Detail & Related papers  (2026-06-16T06:21:14Z)
• Regimes: An Auditable, Held-Out-Gated Improvement Loop Demonstrated on LongMemEval with ActiveGraph [0.0]
  We show that an event-sourced agent runtime turns controlled improvement into a first-class workflow.<n>When the agent's state is a deterministic projection of an append-only event log, failures are recorded, a run replays exactly from its log, and candidate patches scope to typed pipeline seams, gates are auditable.<n>We demonstrate this with Regimes, a loop on the ActiveGraph runtime that diagnoses failed evaluations, proposes a repair at a pipeline point, and promotes it only after static checks, sandbox execution, in-sample evaluation, and held-out validation.
  arXiv  Detail & Related papers  (2026-06-08T23:04:35Z)
• The Path Matters: Learning a Token-Commitment Policy for Diffusion Language Models [52.93186090124315]
  We argue that token commitment can be learned as a reusable trace-state policy.<n>We introduce TraceLock, a lightweight plug-in controller that instantiates this policy for a frozen diffusion language model.
  arXiv  Detail & Related papers  (2026-05-23T18:23:46Z)
• Verify-Gated Completion as Admission Control in a Governed Multi-Agent Runtime: A Bounded Architecture Case Study [0.6875312133832079]
  We study verify-gated completion as an admission-control pattern for governed multi-agent runtimes.<n>We show that under observed conditions, a read-only verify gate plus packetized admission records made completion decisions inspectable and fail-closed.
  arXiv  Detail & Related papers  (2026-05-18T07:52:13Z)
• Affordance Agent Harness: Verification-Gated Skill Orchestration [45.231685718099264]
  Affordance grounding requires identifying where and how an agent should interact in open-world scenes.<n>We propose Affordance Agent Harness, a closed-loop runtime that unifies skills with an evidence store and cost control.
  arXiv  Detail & Related papers  (2026-05-01T13:45:16Z)
• IMPACT-CYCLE: A Contract-Based Multi-Agent System for Claim-Level Supervisory Correction of Long-Video Semantic Memory [73.22944697933603]
  Existing pipelines produce opaque, end-to-end outputs that expose no intermediate state for inspection.<n>We present IMPACT-Cycle, a supervisory multi-agent system that reformulates long-video understanding as a multimodal iterative claim-level maintenance.
  arXiv  Detail & Related papers  (2026-04-22T03:03:33Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• A Physical Agentic Loop for Language-Guided Grasping with Execution-State Monitoring [5.437966695589128]
  We reformulate language-guided grasping as a bounded embodied agent operating over grounded execution states.<n>We introduce a physical agentic loop that wraps an unmodified learned manipulation primitive.<n>We validate the resulting loop on a mobile manipulator with an eye-in-hand D405 camera.
  arXiv  Detail & Related papers  (2026-04-08T08:01:35Z)
• OpenKedge: Governing Agentic Mutation with Execution-Bound Safety and Evidence Chains [2.124730017640531]
  We introduce OpenKedge, a protocol that redefines mutation as a governed process.<n>Intent-to-Execution Evidence Chain (IEEC) links intent, context, policy decisions, execution bounds, and outcomes into a unified lineage.<n>We evaluate OpenKedge across multi-agent conflict scenarios and cloud infrastructure mutations.
  arXiv  Detail & Related papers  (2026-04-07T22:51:08Z)
• AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management [47.49917373646469]
  Existing defenses treat bloated memory as given and focus on remaining resilient.<n>We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management.
  arXiv  Detail & Related papers  (2026-02-07T06:28:51Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.