AID-Guard: Stateful Authorization for Delegated Agent Effects

• URL: http://arxiv.org/abs/2608.21159v1
• Date: Fri, 21 Aug 2026 14:31:29 GMT
• Title: AID-Guard: Stateful Authorization for Delegated Agent Effects
• Abstract summary: AID-Guard is a stateful authorization-to-effect closure protocol.<n>It revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Tool-using AI agents turn delegated tasks into provider effects, yet authorization often ends at admission while provider state, delivery, retry, and recovery evolve. A request may change before commit, or response loss may cause a replacement to create a second effect from one approval. We present AID-Guard, a stateful authorization-to-effect closure protocol. It revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result or certified no effect with a delivery fence. For supported provider contracts, one reservation yields at most one effect across retry and recovery. To our knowledge, it is the first evaluated agent-authorization protocol to unify these controls in one lifecycle. We implement a Python/SQLite prototype. In a declared loopback MCP domain, 13 live mutations caused no unauthorized provider effects, three concurrent histories were linearizable, and evidence bundles supported public verification and replay. All 210 Stripe provider-contract trials matched predeclared outcomes. Across Stripe and Resend, 40 terminalize-successor schedules, 30 overlapping races, and 10 crash-recovery schedules completed without duplicate effects. Under complete proposer compromise, AID-Guard blocked 44/44 attacks and admitted 44/44 matched legitimate proposals. Its strict exact-manifest profile reduced benign utility by 35.4 to 43.8 percentage points; a typed frontier recovered 9-10 completions without observed unsafe effects. A composition study blocked 20/20 post-admission lifecycle attacks and preserved 8/8 valid or exact-retry executions. The results support authorization-to-effect binding under the evaluated effect-path inventory, provider contracts, and failure schedules.

Related papers

• AcquireBound: Runtime Authorization for Resources Acquired by AI Agents [0.0]
  Post-fulfillment activation gap spans tool-mediated creation, inter-agent delegation, and agentic commerce.<n>We present AcquireBound, a provenance-bounded runtime authorization architecture.<n>We prove eight safety properties covering quarantine, backing, non-amplification, split non-evasion, crash/retry, refunds, epochs, and effect confinement.
  arXiv  Detail & Related papers  (2026-09-13T19:16:44Z)
• Recoverability as a System Primitive for Long-Horizon AI Agents [5.008310199603767]
  We introduce recoverability as a system primitive that makes reuse an explicit decision.<n>Four deterministic and 20 paired file challenges demonstrate that accurate restoration and successful completion can conceal disallowed starting points.
  arXiv  Detail & Related papers  (2026-09-12T02:54:33Z)
• When Does Authorization End? Effect Closure at Provider Boundaries [0.0]
  A grant is closed when its existing authorizations retain no such path, and it cannot issue any new ones.<n>We presentBOUND EFFECT, which uses an evidence-supported finite contract to decide whether an interface can truthfully report closure while required work completes.<n>Across GitHub, NATS, and Kafka, closure fails in three ways: an interface lacks a needed control, clean state hides active work, or the model stops before the effect frontier---the last point where the effect can be prevented.
  arXiv  Detail & Related papers  (2026-09-02T17:50:39Z)
• From Traceability to Justifiability: Accountability Structures in Agentic Software Engineering [0.0]
  We measure, from public material only, whether AI records can express a claim and whether they hold where declared.<n>Across 188 double-graded cells we found no platform whose default record emits a content identity of a behavioral system.<n>An instrument computes realized assurance depth from a pipeline's published exhaust alone and compares it with the declared depth.
  arXiv  Detail & Related papers  (2026-08-21T16:45:00Z)
• One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI [0.0]
  We show that a remediation applied by one control can change the action, evidence, or context another control evaluates, invalidating that control's earlier judgment.<n>We formalize this coupling and give a remediate-and-regate protocol that restores per-action soundness in the current bounded, idempotent setting.<n>This is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.
  arXiv  Detail & Related papers  (2026-08-18T22:24:44Z)
• From Trajectories to Evidence: Auditable Experimental Records for Industrial Research Agents [47.678562263387214]
  Research agents increasingly conduct multi-round machine-learning experiments in industrial recommendation settings.<n>Yet a completed trajectory is not automatically evidence: generated artifacts may be unsupported or incomplete, executed rounds may be invalid or confounded, and later modifications may obscure earlier findings.<n>We introduce an evidence-grounded framework that couples bounded verification of consequential artifacts with post-execution claim qualification.
  arXiv  Detail & Related papers  (2026-08-05T13:37:38Z)
• Turning Interaction History into Execution State: A Runtime Layer for Long-Horizon Coding Agents [48.967927222079965]
  Ledger is a runtime layer that distills an agent's completed interactions into an explicit execution state.<n> Ledger keeps this state in an online execution ledger and applies it at two boundaries of every step.<n>Across all 500 SWE-bench Verified instances, Ledger raises Pass@1 from 56.2% to 64.2% with GPT-5 mini and from 75.8% to 81.0% with MiniMax M2.5.
  arXiv  Detail & Related papers  (2026-08-01T18:25:00Z)
• Preventing Premature Commitment in Coding Agents with an Evidence-Conditioned Execution Layer [38.62073085926841]
  LLM-based coding agents edit source code or submit patches before examining enough repository evidence to justify the change.<n>We present ECLoop, an execution layer that interposes between the agent and the repository to enforce evidence-conditioned execution.
  arXiv  Detail & Related papers  (2026-07-30T20:16:35Z)
• Looping Is Not Reliability: State-Bound Evidence and Typed Revision Contracts for Agentic Code Repair [36.56438114281786]
  We study the gap between finding a correct patch and retaining, verifying, and submitting it.<n>We derive an evidence-bound typed loop contract and instantiate its mechanically enforceable subset in a reference implementation.
  arXiv  Detail & Related papers  (2026-07-27T16:05:23Z)
• Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-generated Workflows [0.764671395172401]
  Agentic Transaction Processing treats generated actions as untrusted proposals until they pass deterministic admission under a declared, executable constraint set C.<n>We realize ATP in Mnemosyne, a runtime with an append-only transition log, effective-state projection, dependency-safe compensation, and active commitment records.<n>A reproducible artifact rejects the targeted violations across nine falsification tests while still admitting valid work, at under 6% overhead, and local repair edits an order of magnitude fewer operations than global recompute.
  arXiv  Detail & Related papers  (2026-06-30T23:33:16Z)
• GoodDiffusion: Proactive Copyright Protection for Diffusion Bridge Models via Learnable Sample-specific Signatures [88.63093209858387]
  We propose GoodDiffusion, inspired by backdoor mechanisms, to enforce model-level use-time control.<n>GoodDiffusion preserves high-quality generation for authorized queries carrying valid signatures, yet refuses to generate for unauthorized inputs.<n>To strengthen security, we introduce a Learnable Signature Network (LSN) that assigns sample-specific signatures conditioned on each input.
  arXiv  Detail & Related papers  (2026-06-29T04:07:09Z)
• Hierarchical Advantage Weighting for Online RL Fine-Tuning of VLAs from Sparse Episode Outcomes [40.20394793623452]
  When pretrained VLA policies are fine-tuned through online RL, each rollout episode produces only a single binary outcome.<n>We propose Hierarchical Advantage-Weighted Behavior Cloning (HABC), which trains separate critic heads for viability and efficiency.<n>HABC raises success from supervised fine-tuning (SFT) baselines of 36%, 44%, and 12% to 92%, 88%, and 38%.
  arXiv  Detail & Related papers  (2026-06-15T17:57:14Z)
• PACE: Anytime-Valid Acceptance Tests for Self-Evolving Agents [0.0]
  Self-evolving agents improve by repeatedly proposing changes to their own prompts, skills, ormodifications.<n>On Qwen2.5 agents (0.5B-3B) self-evolving at the prompt level on GSM8K, SVAMP, and ARC-Challenge, greedy acceptance commits 30-42% false and 10-33% harmful edits.<n> PACE commits the real one and essentially nothing else, matching greedy's held-out accuracy at sharply lower variance and about 18% lower evaluation cost.
  arXiv  Detail & Related papers  (2026-06-06T11:12:11Z)
• ANNEAL: Adapting LLM Agents via Governed Symbolic Patch Learning [12.44509691077682]
  We introduce ANNEAL, a neuro-symbolic agent that converts recurring failures into governed symbolic edits of a process knowledge graph.<n>Its core mechanism, Failure-Driven Knowledge Acquisition (FDKA), localizes the responsible operator, synthesizes a typed patch through constrained LLM generation, and validates the proposal.<n>Across four domains and 27 multi-seed runs, ANNEAL is the only evaluated system that commits persistent structural repairs.
  arXiv  Detail & Related papers  (2026-05-04T05:24:03Z)
• IMPACT-HOI: Supervisory Control for Onset-Anchored Partial HOI Event Construction [72.51952455865155]
  We present IMPACT-HOI, a mixed-initiative framework for annotating egocentric procedural video.<n> IMPACT-HOI frames this task as the incremental resolution of a partially specified, onset-anchored event state.<n>A user study with 9 participants shows a 13.5% reduction in manual annotation actions, a 46.67% event match rate, and zero confirmed-field violations.
  arXiv  Detail & Related papers  (2026-05-03T01:37:40Z)
• Affordance Agent Harness: Verification-Gated Skill Orchestration [45.231685718099264]
  Affordance grounding requires identifying where and how an agent should interact in open-world scenes.<n>We propose Affordance Agent Harness, a closed-loop runtime that unifies skills with an evidence store and cost control.
  arXiv  Detail & Related papers  (2026-05-01T13:45:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.