{"as_of":"2026-08-08T19:16:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:dcf254153c9908a86a8be7b0b75e9f7777ea1d3da4919319fcf2923a9a6baa94","coverage":[{"denominator":29,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":29,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-02T10:32:34.305658Z","state":"measured"},{"denominator":31,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":31,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T21:46:23.178867Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-08-07T21:46:23.228007Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2606.22916","snapshot_observed_at":"2026-08-01T02:43:24.437055Z","title":"Intent-governed tool authorization for AI agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.437055Z"},"links":{"cited_paper":"/paper/2606.22916","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:bc3fa4a0c3c078f3bc2ec937f7a03c641816a4b79de7a3db50e8522fb267b63a","observation_id":"889e1901-795c-4aed-8869-f65b2837f1dd","resolution":{"observed_at":"2026-08-01T02:43:24.437055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"cited_work":{"arxiv_id":"2606.22916","doi":null,"metadata_source":"pith","pith_arxiv_id":"2606.22916","snapshot_observed_at":"2026-08-07T21:46:23.228007Z","title":"Intent-Governed Tool Authorization for AI Agents","venue":"cs.AI","work_id":"b3b6a90e-1e94-4c84-8ae5-5a31f133ad54","year":2026},"citing_paper":{"arxiv_id":"2608.05884","last_updated":"2026-08-06T11:06:06Z","snapshot_observed_at":"2026-08-08T18:16:12.920397Z","submitted_at":"2026-08-06T11:06:06Z","title":"The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-07T21:46:23.178867Z"},"links":{"cited_paper":"/paper/2606.22916","citing_paper":"/paper/2608.05884"},"observation_digest":"sha256:6dcab18c2444e4e7255a8c51b204868f270bc90ee71ae7c99c66e907523b0062","observation_id":"fdc261ba-1e82-46d5-a9b2-c2aa5dc85c59","resolution":{"observed_at":"2026-08-07T21:46:23.233895Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2606.22916/citation-record","integrity":"/paper/2606.22916/integrity","json":"/paper/2606.22916/citation-record.json","paper":"/paper/2606.22916"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.190015Z","title":"Mitchell, and Helen Nissenbaum","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.190015Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:6ac4596e40d1570dd775f0648b6eb44816d9c750a78f101f73a3b87234daebf1","observation_id":"35e4b550-9009-4b6e-a0c5-77af0bd29a83","resolution":{"observed_at":"2026-08-02T10:32:34.190015Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.195425Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.195425Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:1d9892c0873883ee81322b3e54fc7fb06c92925490ce3dd43e18cfb4413699f7","observation_id":"4ad0b115-7c52-4a14-bf3e-af0d0a81cb75","resolution":{"observed_at":"2026-08-02T10:32:34.195425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.200454Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.200454Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:30ff5e6fd349b755d359403529d2945e5e0d9948d46a4036f668135bd07a4dc2","observation_id":"e6925ba9-b5db-4f60-947d-7fd4af1dd12e","resolution":{"observed_at":"2026-08-02T10:32:34.200454Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.204718Z","title":"Ferraiolo and D","venue":null,"work_id":null,"year":1992},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.204718Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:a53476b26c349b119b874e4ea0ee723b05cdb90679678f1e63d24243a61c6479","observation_id":"1d6554e7-29dd-475e-b524-7a9b20ba8dd0","resolution":{"observed_at":"2026-08-02T10:32:34.204718Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.209047Z","title":"Operationalizing Contextual Integrity in Privacy-Conscious Assistants, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.209047Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:ccf1d012882240f1a099708d97d320925c09d1ad94a596553e39b7e29775912f","observation_id":"d0f6652c-2c24-4d45-a1d0-def0189e696e","resolution":{"observed_at":"2026-08-02T10:32:34.209047Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.213183Z","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.213183Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:4b8d464267c2e5241d58b0ea5004142704116fad56ea057d1f7f141c3a71bb8e","observation_id":"5148af58-0ae0-44f1-8027-39fb613b014a","resolution":{"observed_at":"2026-08-02T10:32:34.213183Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.217976Z","title":"Hu, David Ferraiolo, D","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.217976Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:f7bf080c012fa0ef1fe473fbf44da0980554d0fa8f41d4f5f52ea1335c354f24","observation_id":"95a6121f-b61e-4f21-abb2-81c8b95b9eee","resolution":{"observed_at":"2026-08-02T10:32:34.217976Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.221964Z","title":"Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.221964Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:65c19cd88eb2b10c38d028450240ffbd2044ef41e636bec30325164db5b4cdea","observation_id":"aadee338-8424-4dab-bc4b-2a7b4a7e7a9d","resolution":{"observed_at":"2026-08-02T10:32:34.221964Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.226055Z","title":"Need to Know: Contextual-Integrity-Grounded Query Rewriting for Privacy-Conscious LLM Delegation, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.226055Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:8502b54541203b2e5f49da53e89271e36a753157e75b8cdb3b12eb52f999ded6","observation_id":"155969ce-f6d2-48af-b01b-39ac1b6ec51a","resolution":{"observed_at":"2026-08-02T10:32:34.226055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.230584Z","title":"Securing the Model Context Protocol: Defending LLMs Against Tool Poisoning and Adversarial Attacks, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.230584Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:fbe83b0cd430af28022084e0e26e09650ed504cb1c5c94565eb5a1e81c0b9625","observation_id":"fc683ac0-ffc0-49de-bb82-d0b72c09f240","resolution":{"observed_at":"2026-08-02T10:32:34.230584Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.234585Z","title":"AgentDyn: A Dynamic Open-Ended Benchmark for Evaluating Prompt Injection Attacks of Real-World Agent Security System, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.234585Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:fdee5c23cd897aec331190e940915bdcd4ab52962b3068f6b2d54ea867c61ceb","observation_id":"04527dff-7c3f-442d-a8ec-6f0de9fb2625","resolution":{"observed_at":"2026-08-02T10:32:34.234585Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.238425Z","title":"ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilities, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.238425Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:8c95c94861b096ff30eeb1ac7c9dfde7edc023e80f859e0021c1bb96d9bd7684","observation_id":"07390d51-9322-4ebd-b180-551a78573fc9","resolution":{"observed_at":"2026-08-02T10:32:34.238425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.242656Z","title":"Authorization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.242656Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:b9fd1ef30ed1d044319f9c44cae78c4b103a4e025a5ff8efd19842082458f320","observation_id":"f1ba5f8d-8550-411d-af00-4b72ce3fe447","resolution":{"observed_at":"2026-08-02T10:32:34.242656Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.246480Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.246480Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:95d1b2d2b4e440545059f77535401c40ffa9ee8bd50eb12e0f9912edebe1128d","observation_id":"ce07bee1-4c59-4d39-846f-8db0deceea91","resolution":{"observed_at":"2026-08-02T10:32:34.246480Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.250987Z","title":"Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.250987Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:5892dec54c718739950fdc4bf17df84793ece33b24f3a196b729a372d198ddae","observation_id":"4305c0a2-561c-46c6-a159-87cd8ffc45bb","resolution":{"observed_at":"2026-08-02T10:32:34.250987Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.254698Z","title":"Stanford University Press, 2009","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.254698Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:78b9ca6c89ac88a861528974325be48d5bb063ef794fa2b64c32008ba815f100","observation_id":"317a95c7-4542-42b8-965f-5bcff794f96d","resolution":{"observed_at":"2026-08-02T10:32:34.254698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.258538Z","title":"LLM01:2025 Prompt Injection","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.258538Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:07cb0b5e8cf8c29719176a0be6ebf4aaa59c65d6b102bc64b0be4143adc4724d","observation_id":"248fada8-082e-454e-bf66-5b1528e87fe2","resolution":{"observed_at":"2026-08-02T10:32:34.258538Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.262506Z","title":"OW ASP Top 10 for LLM Applications 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.262506Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:d78c5fef6e4d87567f46afa046a179bb90e3032dd9ebeed206a093409cccb511","observation_id":"ea0dbd09-bbb0-40bd-b484-24a0b327d865","resolution":{"observed_at":"2026-08-02T10:32:34.262506Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.266439Z","title":"Maddison, and Tatsunori Hashimoto","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.266439Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:0093e597d21d813faa66f101d5157ea31d123d661751a722329a03fa3e9b4b58","observation_id":"12854581-b907-4f19-8917-076c26188621","resolution":{"observed_at":"2026-08-02T10:32:34.266439Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.270482Z","title":"Saltzer and Michael D","venue":null,"work_id":null,"year":1975},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.270482Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:66404b8986fd7c1b367c364284a931915ac37ac6dc4e37b4f1a872802de83313","observation_id":"24193b09-c495-4e28-a941-85aa18df27b7","resolution":{"observed_at":"2026-08-02T10:32:34.270482Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.274818Z","title":"MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.274818Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:a3a477539bd38b6b30dcff47a59d1f70416b2cc5e04a175b10444f266c555f2d","observation_id":"18747825-aa31-4fc9-846d-f4d8f8e1e8e5","resolution":{"observed_at":"2026-08-02T10:32:34.274818Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.278453Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.278453Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:43ce74a4312bf9b0cbd56a4ea53bdfb03a0737c3a826380ab9dfc9f4937b2cb0","observation_id":"eebae825-626a-4ea0-84ab-2ac6ce20bfb7","resolution":{"observed_at":"2026-08-02T10:32:34.278453Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.282521Z","title":"ToolTweak: An Attack on Tool Selection in LLM-based Agents, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.282521Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:364fc550261c11d87c2f2b4b9e2939188aa6b86f8150c92ae908af1ffd75c060","observation_id":"00621fd8-9e55-4b4d-bda7-b74ec9383132","resolution":{"observed_at":"2026-08-02T10:32:34.282521Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.286490Z","title":"Data Guard: A Fine-grained Purpose-based Access Control System for Large Data Warehouses, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.286490Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:33dbd36539747d2159f7febb11488d524156dd70751058b067df64dbe0027ae3","observation_id":"98643bf9-498f-43c6-9087-381d3c6661fd","resolution":{"observed_at":"2026-08-02T10:32:34.286490Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.290321Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.290321Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:ddbdd2a14ed55aa353a16df8a060f89de578567a0a7950bbf45ccad3f48f612f","observation_id":"e214b054-0206-4d5e-b16d-f35e9c1af57b","resolution":{"observed_at":"2026-08-02T10:32:34.290321Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.294081Z","title":"Messaging with Purpose Limitation – Privacy-Compliant Publish-Subscribe Systems, 2021","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.294081Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:d8a4f3072615fc073b4d6de0f94941a71c277ffd46a1a985dac254edf43e33ad","observation_id":"16334e18-31fb-4d43-803b-2114a0d375c8","resolution":{"observed_at":"2026-08-02T10:32:34.294081Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.297969Z","title":"τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.297969Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:7e5cc8ae05d599a89a4a54c27757227ea9834781dbcdca70d5b573d7f54c1238","observation_id":"cf519791-baee-479a-aa36-7bbec0918fb1","resolution":{"observed_at":"2026-08-02T10:32:34.297969Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.301794Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.301794Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:a75f365634ff9881c5cc3485ac3da77b1839138dc322a1be5cf2eb85f9d141ac","observation_id":"425f23c7-a4f1-4650-9752-c017d720c82f","resolution":{"observed_at":"2026-08-02T10:32:34.301794Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.305658Z","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.305658Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:1ae3955d01ef994d860fdb31e9bfd368f2eb0ca50f3a569b43d578b4c0d32d4c","observation_id":"b8d8d1d6-3e6d-47e0-b085-4800c10f72d7","resolution":{"observed_at":"2026-08-02T10:32:34.305658Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","latest_version":3,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents"},"reference_resolution":{"displayed":29,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":29,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":29},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 29 of 29 outbound references and 2 inbound Pith citation observations for arXiv:2606.22916."}