VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows

• URL: http://arxiv.org/abs/2608.30091v1
• Date: Sun, 30 Aug 2026 23:39:26 GMT
• Title: VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows
• Abstract summary: We introduce VERA (Verifiable Edge Revocation for Agents), a verifier-checkable revocation contract and API emitted by agent-runtime adapters as signed evidence.<n>Under disjunctive authority, revoking edge e proofss exactly invalidate T_intent(e,G) = reach(G) reach(G e, the agents whose every authorizing root path used e.<n>In a LangGraph framework-replt cells repeated 20 times yield 500compiled-framework traces and 2,000 valid signed delegation decisions.
• Score: 3.06815294082031
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation APIs still resemble token or subtree invalidation. When one delegation is withdrawn, the runtime must know which agents lose authority while independently authorized agents keep working. We study this authority consistency problem and introduce VERA (Verifiable Edge Revocation for Agents), a verifier-checkable revocation contract and API emitted by agent-runtime adapters as signed evidence. Under disjunctive authority, revoking edge e invalidates exactly T_intent(e,G) = reach(G) \ reach(G \ {e}), the agents whose every authorizing root path used e. Used as a contract, this target exposes two runtime failures: tree cascades over-revoke shared agents, while deployer-scoped cascades under-revoke cross-domain descendants. In a LangGraph framework-replt cells repeated 20 times yield 500compiled-framework traces and 2,000 valid signed delegation decisions; 13/25 cells contain runtime multi-parsharing and 8/25 contain cross-deployer shies 500/500 target proofs, preserves all320 alternate-parent shared-agent cases that tree cascade revokes, and rejects unauthorized signers and omission attacks. Baseline replay over 1,9that holder/node and tree-style targetscannot express this behavior. We further validate schema portability on A2A, AutoGen, and CrewAI artifacts: nine traces, including five executable Cregned delegation events that pass schema and signature checks.

Related papers

• Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning [67.04448659688579]
  FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.<n>Federation is not optional: off-the-shelf transfer collapses under distribution shift.<n>Live FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.
  arXiv  Detail & Related papers  (2026-09-02T07:57:12Z)
• Agent Flight Recorder: Tamper-Evident Audit Trails with On-Chain Anchoring for Long-Horizon Tool-Using Agents [0.6564588068252765]
  Long-horizon agents execute thousands of actions, resulting in sequential failures rather than isolated errors.<n>The Agent Flight Recorder captures each agent action as a structured semantically serialized event binding eight fields from intent through execution to provenance.<n>We evaluate the system across five cumulative ablation configurations on synthetic agent workloads.
  arXiv  Detail & Related papers  (2026-09-01T22:59:08Z)
• Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems [0.0]
  We present a threat model for multi-agent delegation centered on four adversaries.<n>We show a default runtime modeling common practice fails all four threats.<n>We implement and adversarially evaluate an authorization broker that closes the gap.
  arXiv  Detail & Related papers  (2026-08-31T19:09:34Z)
• Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems [3.276413627586882]
  After an incident, a verifier must answer two questions.<n>Credentials establish who may act, but need not bind them to later output bytes.<n>A trusted deployer runtime signs a hash of each released output.
  arXiv  Detail & Related papers  (2026-08-31T07:42:57Z)
• Where Accountability Lives: Mapping Human Responsibility to Workflow Artifacts in Agentic Software Development [0.0]
  Coding agents author, open pull requests, and push code in production repositories.<n>We read both against the workflow events that leave artifacts, across four agentic coding tools and eighteen governing policy documents from seven providers.<n>One provider bars the developer who assigned a task from approving the resulting pull request; another documents an agent that approves pull requests below a configured risk threshold and can dismiss reviews.<n>We replace the usual three-way distinction between enforced, advisory and absent verification with a grid separating whether a mechanism compels the check from who performs it.
  arXiv  Detail & Related papers  (2026-08-16T11:11:04Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A [0.0]
  Invocation-Bound Capability Tokens (IBCTs) fuse identity, authorization, and provenance binding into a single append-only token chain.<n>We provide reference implementations in Python and Rust with full cross-language interoperability.
  arXiv  Detail & Related papers  (2026-03-25T19:45:37Z)
• Agentic Peer-to-Peer Networks: From Content Distribution to Capability and Action Sharing [10.47562113256175]
  This article outlines the networking foundations needed to make such collaboration practical.<n>We propose a plane-based reference architecture that decouples connectivity/identity, semantic discovery, and execution.<n>We also present a textittiered verification spectrum: Tier1 relies on reputation signals, Tier2 applies lightweight canary challenge-response with fallback selection, and Tier3 requires evidence packages such as signed tool receipts/traces.
  arXiv  Detail & Related papers  (2026-03-04T05:58:44Z)
• AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management [47.49917373646469]
  Existing defenses treat bloated memory as given and focus on remaining resilient.<n>We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management.
  arXiv  Detail & Related papers  (2026-02-07T06:28:51Z)
• BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents [58.83028403414688]
  Large language model (LLM) agents execute tasks through multi-step workflow that combine planning, memory, and tool use.<n>Backdoor triggers injected into specific stages of an agent workflow can persist through multiple intermediate states and adversely influence downstream outputs.<n>We propose textbfBackdoorAgent, a modular and stage-aware framework that provides a unified agent-centric view of backdoor threats in LLM agents.
  arXiv  Detail & Related papers  (2026-01-08T03:49:39Z)
• Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents [0.6747475365990533]
  In agentic settings reasoning, prompt injection, or multi-agent orchestration can silently expand privileges.<n>We introduce Agentic JWT (A-JWT), a dual-faceted intent token that binds each agent's action to verifiable user intent.<n>A-JWT carries an agent's identity as a one-way hash derived from its prompt, tools and configuration.
  arXiv  Detail & Related papers  (2025-09-16T23:43:24Z)
• Dissecting Adversarial Robustness of Multimodal LM Agents [70.2077308846307]
  We manually create 200 targeted adversarial tasks and evaluation scripts in a realistic threat model on top of VisualWebArena.<n>We find that we can successfully break latest agents that use black-box frontier LMs, including those that perform reflection and tree search.<n>We also use ARE to rigorously evaluate how the robustness changes as new components are added.
  arXiv  Detail & Related papers  (2024-06-18T17:32:48Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.