Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents

• URL: http://arxiv.org/abs/2607.10487v1
• Date: Sat, 11 Jul 2026 21:48:53 GMT
• Title: Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents
• Abstract summary: We study the commit boundary at which earlier authority evidence no longer authorizes a durable effect.<n>A durable effect is authorized only if the witness that licensed its derived state remains fresh, causally prior, bound to the same effect, and eligible at commit time.<n> CommitGuard blocks stale durable-effect attempts on protected commit surfaces when runtimes emit witness, dependency, binding, and eligibility signals.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result. We study the commit boundary at which earlier authority evidence no longer authorizes a durable effect. We call this property commit-time authorization: a durable effect is authorized only if the witness that licensed its derived state remains fresh, causally prior, bound to the same effect, and eligible at commit time. We build a controlled-invalidation suite spanning browser, tool/API, and multi-agent workflows. The suite preserves the user goal and payload shape while invalidating the authority relation before durability. In the primary 54-task matrix, endpoint success remains high: 262/270 runs reach the visible result. Only 55/270 are authorized completions; among the 216 invalidating rows, 207 commit after the authorizing path has failed. All 54 clean controls remain authorized, and a separate 54-run authority-preserving check produces no unauthorized commits. We then evaluate mitigation families. Prompt caution and single-condition checks are insufficient because different hazards break different boundary conditions. Defenses work when they refresh, rebind, replan, or refuse at the durability boundary. CommitGuard, a fail-closed boundary monitor, blocks stale durable-effect attempts on protected commit surfaces when runtimes emit witness, dependency, binding, and eligibility signals. The result is a reporting and runtime-design lesson: endpoint success is a utility metric; authorized commit is a security property.

Related papers

• Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound [4.805352087824778]
  ClosureBound binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs.<n>It re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound.<n>A lexical audit of 549 public Skills finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field.
  arXiv  Detail & Related papers  (2026-09-05T06:27:52Z)
• When Does Authorization End? Effect Closure at Provider Boundaries [0.0]
  A grant is closed when its existing authorizations retain no such path, and it cannot issue any new ones.<n>We presentBOUND EFFECT, which uses an evidence-supported finite contract to decide whether an interface can truthfully report closure while required work completes.<n>Across GitHub, NATS, and Kafka, closure fails in three ways: an interface lacks a needed control, clean state hides active work, or the model stops before the effect frontier---the last point where the effect can be prevented.
  arXiv  Detail & Related papers  (2026-09-02T17:50:39Z)
• AID-Guard: Stateful Authorization for Delegated Agent Effects [0.0]
  AID-Guard is a stateful authorization-to-effect closure protocol.<n>It revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result.
  arXiv  Detail & Related papers  (2026-08-21T14:31:29Z)
• Beyond Memory: A Transactional Continuity Kernel for Long-Lived AI Agents [2.124730017640531]
  Persistent AI agents accumulate versioned state across long horizons, but storage retention alone does not identify authoritative state.<n>We argue that agent state governance is an infrastructural activation problem, defining continuity as an unbroken, authorized lineage of accepted branch heads.<n>We present the Continuity Kernel (CK), an activation contract that decouples off-commit candidate evaluation from atomic state activation.
  arXiv  Detail & Related papers  (2026-08-12T04:28:49Z)
• Turning Interaction History into Execution State: A Runtime Layer for Long-Horizon Coding Agents [48.967927222079965]
  Ledger is a runtime layer that distills an agent's completed interactions into an explicit execution state.<n> Ledger keeps this state in an online execution ledger and applies it at two boundaries of every step.<n>Across all 500 SWE-bench Verified instances, Ledger raises Pass@1 from 56.2% to 64.2% with GPT-5 mini and from 75.8% to 81.0% with MiniMax M2.5.
  arXiv  Detail & Related papers  (2026-08-01T18:25:00Z)
• Towards Trustworthy Embodied Intelligence: A Systems Framework and Graded Trustworthiness Levels [53.63220028820581]
  Embodied intelligence integrates learned perception and decision making with real-time computation, control, and physical interaction.<n>We define trustworthy embodied intelligence as the sustained capacity to execute specified tasks reliably.
  arXiv  Detail & Related papers  (2026-07-28T17:50:44Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents [0.0]
  PORTICO is a reference monitor for capabilities exposed to the planner.<n>It compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules.
  arXiv  Detail & Related papers  (2026-06-21T13:52:37Z)
• Cordon: Semantic Transactions for Tool-Using LLM Agents [11.567293065381918]
  This paper introduces Cordon, a transactional runtime system for staging and validating agent effects before commit.<n>It reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.
  arXiv  Detail & Related papers  (2026-06-16T06:21:14Z)
• ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation [11.138472843474505]
  We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers.<n>On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8%.<n>Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement.
  arXiv  Detail & Related papers  (2026-05-26T04:44:59Z)
• Your Agents Are Aging Too: Agent Lifespan Engineering for Deployed Systems [60.79651380135334]
  Long-lived AI agents are increasingly deployed as persistent operational systems.<n>How long does an agent remain reliable after deployment?<n>We introduce AgingBench, a longitudinal reliability benchmark for agent lifespan engineering.
  arXiv  Detail & Related papers  (2026-05-25T19:55:12Z)
• Verify-Gated Completion as Admission Control in a Governed Multi-Agent Runtime: A Bounded Architecture Case Study [0.6875312133832079]
  We study verify-gated completion as an admission-control pattern for governed multi-agent runtimes.<n>We show that under observed conditions, a read-only verify gate plus packetized admission records made completion decisions inspectable and fail-closed.
  arXiv  Detail & Related papers  (2026-05-18T07:52:13Z)
• ClawForge: Generating Executable Interactive Benchmarks for Command-Line Agents [59.626170560327274]
  We present textbfClawForge, a generator-backed benchmark framework for executable command-line categories under state conflict.<n>We instantiate this framework as the ClawForge-Bench (17 scenarios, 6 ability categories)
  arXiv  Detail & Related papers  (2026-05-13T21:34:08Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution [49.689452243966315]
  AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks.<n>We propose CausalArmor, a selective defense framework that computes lightweight, leave-one-out attributions at privileged decision points.<n> Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses.
  arXiv  Detail & Related papers  (2026-02-08T11:34:08Z)
• SABER: Small Actions, Big Errors -- Safeguarding Mutating Steps in LLM Agents [52.20768003832476]
  We analyze execution traces on $$-Bench (Airline/Retail) and SWE-Bench Verified.<n>We formalize emphdecisive deviations, earliest action, level divergences that flip success to failure.<n>We introduce cm, a model-agnostic, gradient-free, test-time safeguard.
  arXiv  Detail & Related papers  (2025-11-26T01:28:22Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.