Separating Disclosure from Authorization: Field-Tier Minimization for Agent Action Mediation

• URL: http://arxiv.org/abs/2608.25474v1
• Date: Wed, 26 Aug 2026 07:45:05 GMT
• Title: Separating Disclosure from Authorization: Field-Tier Minimization for Agent Action Mediation
• Abstract summary: We show that a system that authorizes an action must see enough of it to decide, and a system that attests to its decision must record enough to be audited.<n>We classify each parameter field, not each action class, into three tiers.<n>The central property is that the ledger's commitment is a canonical digest of the full, unminimized parameters.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: A system that authorizes an action must see enough of it to decide, and a system that attests to its decision must record enough to be audited. Both pressures push raw action parameters -- recipients, payment memos, record identifiers -- into an append-only ledger that cannot delete them. We show the two are separable. We classify each parameter field, not each action class, into three tiers: fields a policy may legitimately match on, which cross raw; fields that are policy-relevant but identifying, which cross only as projections such as an email domain or a templated route shape; and fields with no legitimate policy use, which never leave the workload. The central property is that the ledger's commitment is a canonical digest of the full, unminimized parameters, computed before minimization runs. The commitment is therefore independent of the tier table: reclassifying a field changes what is disclosed without invalidating a historical entry, reopening a hash, or altering what an offline verifier checks. Tier table, policy schema and wire schema are generated from one per-action declaration, so the deciding and recording parties cannot hold different rules. We then address a question the architecture forces: which party should compute each attested fact? We argue it is settled by which party could lie about it undetectably, and derive three answers within one request -- the client computes the parameter digest, being the only party holding the data; it is structurally prevented from naming the definition that governed it, since that would write a false statement into a signed ledger; and it attests which tier table it applied, so divergence is detectable. We give a leakage analysis of each projection, report an incident in which a first-cut projection preserved the identifier it was written to remove, and state the residual trust the design does not eliminate.

Related papers

• AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes [38.37599802008238]
  Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped.<n>All existing audits decide backbone identity from the text-output channel.<n>We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs.
  arXiv  Detail & Related papers  (2026-08-30T08:22:12Z)
• One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI [0.0]
  We show that a remediation applied by one control can change the action, evidence, or context another control evaluates, invalidating that control's earlier judgment.<n>We formalize this coupling and give a remediate-and-regate protocol that restores per-action soundness in the current bounded, idempotent setting.<n>This is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.
  arXiv  Detail & Related papers  (2026-08-18T22:24:44Z)
• Never the Number: Structural Abstention for AI Systems Whose Answers Are Consumed as Fact [0.0]
  Large language models have made natural language interfaces to databases newly credible, but calibrated text-to-aggregated systems fail in a way that matters for deployment.<n>We propose an architectural pattern for such systems, a trusted kernel with a generative shell, resting on one invariant.<n>A generative shell interprets under input and phrases replies; a deterministic kernel matches fully specified questions against a bounded set of answerable question shapes.<n>The two meet at a confirmation the user reads before any value is computed, and requests the kernel cannot express are declined rather than approximated.
  arXiv  Detail & Related papers  (2026-08-14T03:53:21Z)
• Suppression Sticks, Locality Is Fragile: A Closed-Loop Target-and-Control Audit of Task-Vector Negation in VLA Policies [33.432377306905735]
  Task-vector arithmetic offers a closed-form way to modify a model, yet its behavioral locality remains unclear in closed-loop robot control.<n>We present a target-and-control audit of per-skill task-vector subtraction from multitask vision-language-action (VLA) policies.
  arXiv  Detail & Related papers  (2026-08-05T10:59:53Z)
• SEER: A Self-Grounded Evidence Interface for Controlled Spatial Relation Classification [71.9783246097687]
  SEER hides candidate relations during pair localization, constructs a query-specific view with explicit subject/object roles, and retains the full image and sparse box geometry as complementary evidence.<n>For relation-choice protocols with exact inverse support, an optional refinement swaps the entity roles and changes the forward decision only when exactly one visual state obeys the corresponding inverse relation.<n>The unchanged protocol yields +4.35 to +11.79 on all 2,434 filtered EmbSpatial pair-relation questions across three models.
  arXiv  Detail & Related papers  (2026-08-04T13:16:15Z)
• CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents [12.471369656645512]
  We ask whether a candidate action stays authorized over a declared neighborhood of plausible correctly bound returns.<n>We prove that certifying the categorical and numerical channels separately does not compose.<n>CAGE certifies this joint neighborhood directly, enumerating the discrete branches exactly.
  arXiv  Detail & Related papers  (2026-07-31T09:11:56Z)
• TRACE: An Operational Reasoning Schema for Auditable Agentic Commitments [0.0]
  TRACE (Typed Reasoning And Commitment Evidence) is a typed, versioned schema for recording reasoning traces.<n>The paper argues in three layers that reasoning is not in the language model.<n>A record-consumer contract states what a record guarantees and what a consumer must honor in return.
  arXiv  Detail & Related papers  (2026-07-14T08:08:21Z)
• From ambiguous utterances to governed reuse classes: canonicalization, quotient invariance, and conditional decidability [0.0]
  Reuse should operate on a mathematically characterized quotient of resolved conversational demands.<n> Reuse identity licenses the governed query key and its certified answer space.<n>The supporting layer is stated at exactly the strength proved.
  arXiv  Detail & Related papers  (2026-07-11T01:49:04Z)
• What Accuracy and Gradient Cosine Miss: Evaluating Feedback Alignment via Scale Stability, Reference Validity, and Depth Utility [48.10132234701036]
  We propose a diagnostic evaluation protocol based on three checks -- scale stability, reference validity, and depth utility -- together with per-layer rather than aggregate cosine reporting.<n>Across multiple architectures and methods, our protocol identifies all failures with wide calibration margins.
  arXiv  Detail & Related papers  (2026-06-19T06:04:17Z)
• OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents [32.5466552510287]
  Leakage is cumulative, as individually innocuous releases accumulate across honest-but-curious or colluding sinks.<n>We present OCELOT, a runtime mediator that budgets how much an adversary's belief about a secret may improve.<n>OCELOT attains significantly lower leakage at higher task utility, resists adaptive injection, jailbreak, cumulative inference, and sink collusion.
  arXiv  Detail & Related papers  (2026-06-10T17:13:35Z)
• Causal Identification from Counterfactual Data: Completeness and Bounding Results [54.147490305295456]
  We develop an algorithm for identifying counterfactual queries from an arbitrary set of Layer 3 distributions.<n>We establish the theoretical limit of which counterfactuals can be identified from physically realizable distributions.<n>We derive novel analytic bounds for such quantities using realizable counterfactual data.
  arXiv  Detail & Related papers  (2026-02-26T22:48:12Z)
• CoP: Factual Inconsistency Detection by Controlling the Preference [45.4045488637761]
  We propose an unsupervised framework named CoP by controlling the preference of the generation model with the help of prompt. With the properly designed prompt, our framework could evaluate specific preferences and serve as measurements for fine-grained categories of inconsistency. Experiments show that our framework achieves new SOTA results on three factual inconsistency detection tasks.
  arXiv  Detail & Related papers  (2022-12-03T13:05:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.