When Does Authorization End? Effect Closure at Provider Boundaries

• URL: http://arxiv.org/abs/2609.02866v1
• Date: Wed, 02 Sep 2026 17:50:39 GMT
• Title: When Does Authorization End? Effect Closure at Provider Boundaries
• Abstract summary: A grant is closed when its existing authorizations retain no such path, and it cannot issue any new ones.<n>We presentBOUND EFFECT, which uses an evidence-supported finite contract to decide whether an interface can truthfully report closure while required work completes.<n>Across GitHub, NATS, and Kafka, closure fails in three ways: an interface lacks a needed control, clean state hides active work, or the model stops before the effect frontier---the last point where the effect can be prevented.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Revocation completion, clean state, or operation success can leave authorized work able to cause an effect the application rejects while the provider stays within its contract. We call the absence of all such paths policy-relative effect closure, or effect closure for short. Thus, a grant is closed when its existing authorizations retain no such path, and it cannot issue any new ones. We present EFFECTBOUND, which uses an evidence-supported finite contract to decide whether an interface can truthfully report closure while required work completes. It reduces this to finite control with hidden state and returns a strategy, an impossibility certificate, or no verdict when evidence is insufficient. Machine-checked proofs establish the reduction and checker soundness; the checker derives closure results and validates certificates. Across GitHub, Kubernetes, NATS, and Kafka, closure fails in three ways: an interface lacks a needed control, clean visible state hides active work, or the model stops before the effect frontier---the last point where the effect can be prevented. The GitHub tool cannot bind a merge to the reviewed commit; a controlled run confirms that it may merge a different commit. NATS can report no stored or pending messages while dispatched work can still publish downstream. In Kafka, all fixed-set brokers had applied the revocation, yet an earlier authorized request could still append. We add a gate that blocks new use of revoked authority and delays return until earlier in-flight work completes. In a fixed-set Kafka~4.3.1 test deployment, this closes the studied synchronous, nontransactional write path without blocking unrelated requests. For a grant, authorization ends only when issuance stops and no earlier authorization can reach an effect the application rejects.

Related papers

• Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound [4.805352087824778]
  ClosureBound binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs.<n>It re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound.<n>A lexical audit of 549 public Skills finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field.
  arXiv  Detail & Related papers  (2026-09-05T06:27:52Z)
• ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use [29.860376266824872]
  OAuth authorization alone does not ensure that a later tool call is executed by the provider-side workload that the relying party intended to trust.<n>We present ACLE-MCP, an invocation-scoped architecture that couples delegated authorization, workload appraisal, and resource-side execution admission.
  arXiv  Detail & Related papers  (2026-09-02T14:58:17Z)
• AID-Guard: Stateful Authorization for Delegated Agent Effects [0.0]
  AID-Guard is a stateful authorization-to-effect closure protocol.<n>It revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result.
  arXiv  Detail & Related papers  (2026-08-21T14:31:29Z)
• $Z^2$-ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN [43.15181031994434]
  We propose a zero-knowledge auditable control and zero-trust verifiable agentic intent architecture.<n>A live large language model is used in the non-real-time path to translate operator intents into Intent Contracts.<n>Results indicate improved actuation filtering and attack resilience at modest latency and signaling cost.
  arXiv  Detail & Related papers  (2026-08-21T12:44:03Z)
• From Trajectories to Evidence: Auditable Experimental Records for Industrial Research Agents [47.678562263387214]
  Research agents increasingly conduct multi-round machine-learning experiments in industrial recommendation settings.<n>Yet a completed trajectory is not automatically evidence: generated artifacts may be unsupported or incomplete, executed rounds may be invalid or confounded, and later modifications may obscure earlier findings.<n>We introduce an evidence-grounded framework that couples bounded verification of consequential artifacts with post-execution claim qualification.
  arXiv  Detail & Related papers  (2026-08-05T13:37:38Z)
• Turning Interaction History into Execution State: A Runtime Layer for Long-Horizon Coding Agents [48.967927222079965]
  Ledger is a runtime layer that distills an agent's completed interactions into an explicit execution state.<n> Ledger keeps this state in an online execution ledger and applies it at two boundaries of every step.<n>Across all 500 SWE-bench Verified instances, Ledger raises Pass@1 from 56.2% to 64.2% with GPT-5 mini and from 75.8% to 81.0% with MiniMax M2.5.
  arXiv  Detail & Related papers  (2026-08-01T18:25:00Z)
• Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents [0.0]
  We study the commit boundary at which earlier authority evidence no longer authorizes a durable effect.<n>A durable effect is authorized only if the witness that licensed its derived state remains fresh, causally prior, bound to the same effect, and eligible at commit time.<n> CommitGuard blocks stale durable-effect attempts on protected commit surfaces when runtimes emit witness, dependency, binding, and eligibility signals.
  arXiv  Detail & Related papers  (2026-07-11T21:48:53Z)
• Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents [0.0]
  PORTICO is a reference monitor for capabilities exposed to the planner.<n>It compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules.
  arXiv  Detail & Related papers  (2026-06-21T13:52:37Z)
• MOSS: Self-Evolution through Source-Level Rewriting in Autonomous Agent Systems [36.221246203666745]
  MOSS is a system that performs self-rewriting at the source level on production agentic substrates.<n>It lifts a four-task mean grader score from 0.25 to 0.61 in a single cycle without human intervention.
  arXiv  Detail & Related papers  (2026-05-21T17:48:33Z)
• Verify-Gated Completion as Admission Control in a Governed Multi-Agent Runtime: A Bounded Architecture Case Study [0.6875312133832079]
  We study verify-gated completion as an admission-control pattern for governed multi-agent runtimes.<n>We show that under observed conditions, a read-only verify gate plus packetized admission records made completion decisions inspectable and fail-closed.
  arXiv  Detail & Related papers  (2026-05-18T07:52:13Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.