{"as_of":"2026-08-08T20:09:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:50115189d83404c416305a4dbc66999b387190564f53f936e130338afa093ae3","coverage":[{"denominator":42,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":42,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T02:43:24.479481Z","state":"measured"},{"denominator":42,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":42,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.25364/citation-record","integrity":"/paper/2607.25364/integrity","json":"/paper/2607.25364/citation-record.json","paper":"/paper/2607.25364"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.352814Z","title":"Language models don’t always say what they think: Unfaithful explanations in chain-of-thought prompting,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.352814Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:7816f7ccbc8e02097c847eda62316c27137451ca46d703c4ebb6ea262d3499ff","observation_id":"1ba4f6a6-30fb-481a-8f5a-90e59fa7c11e","resolution":{"observed_at":"2026-08-01T02:43:24.352814Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.13702","last_updated":"2023-07-17T01:08:39Z","snapshot_observed_at":"2026-07-31T04:21:27.501709Z","submitted_at":"2023-07-17T01:08:39Z","title":"Measuring Faithfulness in Chain-of-Thought Reasoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.13702","snapshot_observed_at":"2026-08-01T02:43:24.356785Z","title":"Measuring faithfulness in chain-of-thought reasoning,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.356785Z"},"links":{"cited_paper":"/paper/2307.13702","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:a9c14c8c330a02aee41c40eb568326c75ccb7365f68030dd9fdf064abfba87e6","observation_id":"30f3eaf1-2751-44ea-8341-6fb671924c9c","resolution":{"observed_at":"2026-08-01T02:43:24.356785Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.15092","last_updated":"2024-09-02T22:40:20Z","snapshot_observed_at":"2026-07-06T18:19:00.169416Z","submitted_at":"2024-05-23T22:38:58Z","title":"Dissociation of Faithful and Unfaithful Reasoning in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.15092","snapshot_observed_at":"2026-08-01T02:43:24.360349Z","title":"Dissociation of faithful and unfaithful reasoning in LLMs,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.360349Z"},"links":{"cited_paper":"/paper/2405.15092","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:ac11fa173eea8e5b09f61f74d813e40a0e2942fed3fef6fb03a35669b2895090","observation_id":"1cceac1a-1566-4796-bcd4-e584f0a64e61","resolution":{"observed_at":"2026-08-01T02:43:24.360349Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.364143Z","title":"ReAct: Synergizing reasoning and acting in language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.364143Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:5cfabd0c6a748d6d2679916dabf96ac6998a0e07dfc72fbdf4e0e3c09defebcc","observation_id":"66d7d7b2-43c9-45ed-9df5-cfde15ee7be0","resolution":{"observed_at":"2026-08-01T02:43:24.364143Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.367334Z","title":"Why should i trust you?: Explaining the predictions of any classifier,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.367334Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:95dc97b59c8e212edbbdbd7b5d6762deed8e3e19294c7e7b02694963a9383852","observation_id":"b4fd514e-2589-4ef1-9f3a-63bc552d2159","resolution":{"observed_at":"2026-08-01T02:43:24.367334Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.370635Z","title":"Explanation in artificial intelligence: Insights from the social sciences,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.370635Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:aa039c54fe742b6b4d25d49ef34fe25b34d64484fd6a9d84883183fa21351873","observation_id":"47aabdc4-0bb3-4bb7-84ad-5ae7e145b974","resolution":{"observed_at":"2026-08-01T02:43:24.370635Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.374468Z","title":"The mythos of model interpretability,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.374468Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:15088c1c069a6daa83d944a7cb29cbacf4507b2d66aea7ad7d36a4463f36495e","observation_id":"476171b9-768c-4051-8dc1-7c8216f482d3","resolution":{"observed_at":"2026-08-01T02:43:24.374468Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.377349Z","title":"Interpreting interpretability: Understanding data scientists’ use of interpretability tools for machine learning,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.377349Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:aa38036668f4e5d3d60c7171bd63d5c780e2080553b995e5e84e87fa439314ef","observation_id":"79da502c-62ce-433c-8703-257314de1352","resolution":{"observed_at":"2026-08-01T02:43:24.377349Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.380532Z","title":"Manipulating and measuring model interpretability,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.380532Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:debd53e6cdba0665a24e0c1d2f317ed76e5f8c7cd94a762876874d4b75887dda","observation_id":"2facfbaf-3ad0-45f4-809d-438e014232c2","resolution":{"observed_at":"2026-08-01T02:43:24.380532Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.383451Z","title":"The protection of information in computer systems,","venue":null,"work_id":null,"year":1975},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.383451Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:70331966ee7323cd35fa251121d30554b3bee6639f4ad6160e3d59eebf69f7bb","observation_id":"8474d2c9-58f9-4df3-9a52-9d220f5cc51e","resolution":{"observed_at":"2026-08-01T02:43:24.383451Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.386727Z","title":"Guide to attribute based access control (ABAC) definition and considerations,","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.386727Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:6a638ef3625ce588add807fcfa1de04731a6c4bdd675b5f494505827f5668c5d","observation_id":"3c88cc5e-9ce7-4304-892a-5d7de42eb12b","resolution":{"observed_at":"2026-08-01T02:43:24.386727Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.389933Z","title":"Not what you’ve signed up for: Compromising real-world LLM-Integrated applications with indirect prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.389933Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:7090145e4f37245fa857e4cc3b086135f7286bde0e515d441efa3c2cf5497f3e","observation_id":"aabd5ec7-50c3-437a-9504-4ce3315f49d3","resolution":{"observed_at":"2026-08-01T02:43:24.389933Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.392897Z","title":"Identifying the risks of LM agents with an LM-Emulated sandbox,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.392897Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:6936d522d29f798c85063d674ca5de043a9c718a2a6b075e7a72bab627b6e0c7","observation_id":"5b4eabb0-c7b8-4c40-9b63-5df472774372","resolution":{"observed_at":"2026-08-01T02:43:24.392897Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.398938Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.398938Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:c3232bd84a63aeef96298bada3752dcbe71b1351941e8bfc99aaa78b91c2213a","observation_id":"6a6fcd77-073b-4781-9175-6342a5c34068","resolution":{"observed_at":"2026-08-01T02:43:24.398938Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.401927Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.401927Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:a4be0c3aba1c5811a067031237b55cba840f7b965d98270221bcf2505ccc1b04","observation_id":"a839a774-fff0-4a4e-9df9-a93eb081b0ec","resolution":{"observed_at":"2026-08-01T02:43:24.401927Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.404813Z","title":"Prompt injection attack to tool selection in LLM agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.404813Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:906dbe3e25dce5f28a2f8417e4beb7c9510a862286ac141b3fea723bb2fcf7b1","observation_id":"e7adc28e-5ca5-46ae-80a4-90807afe7682","resolution":{"observed_at":"2026-08-01T02:43:24.404813Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.407651Z","title":"MCPTox: A benchmark for tool poisoning on real-world MCP servers,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.407651Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:a565fa4e9290cf4d82e9c6dc3af9e623b525a0a7db6b65d2e0dc0e6894774424","observation_id":"95438d9f-decf-490a-9b18-1353d82b4016","resolution":{"observed_at":"2026-08-01T02:43:24.407651Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.410667Z","title":"StruQ: Defending against prompt injection with structured queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.410667Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:99085c80cfc11d169220304a373052c33b8a1a8b1508c69364a72ffda0751b40","observation_id":"e8bcb4a3-5204-483a-862b-dbba69d49b4e","resolution":{"observed_at":"2026-08-01T02:43:24.410667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.413469Z","title":"AttriGuard: Defeating indirect prompt injection in LLM agents via causal attribution of tool invocations,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.413469Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:2d082b12633545ae99b2289b4513c419bb9d3d749800af443ee96e9dbb0688a9","observation_id":"94859335-b483-49c4-af0b-ec5f630aaefe","resolution":{"observed_at":"2026-08-01T02:43:24.413469Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.416234Z","title":"Tools – model context protocol specification, 2025-11-25,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.416234Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:5f7830f054b3485b0ced1cf9442900738b329b3644dcc2bcca6c0e0618c3b33f","observation_id":"f817ebf8-deca-4e8f-b4b7-7bfedb4edc14","resolution":{"observed_at":"2026-08-01T02:43:24.416234Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.418987Z","title":"Authorization – model context protocol specification, 2025-11-25,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.418987Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:595e9d6f49e0f6ce88fdfe5321253aa708df45ba8ee3c9a0cd6956c1fb811fe6","observation_id":"59685e37-29d5-4330-a633-1756888f2d4b","resolution":{"observed_at":"2026-08-01T02:43:24.418987Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.421868Z","title":"Artificial intelligence risk management framework: Generative artificial intelligence profile,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.421868Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:95961902ce46543021225533f57ccab3ea2d4743799644457cbb5299145cb020","observation_id":"7d7a5f4b-1740-4ebf-bef3-9af82886f3bc","resolution":{"observed_at":"2026-08-01T02:43:24.421868Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.424764Z","title":"LLM01:2025 prompt injection,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.424764Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:37f0478078e4c8cab3517059fed4a3c00677ee12950365290b53cf05ecbdc24b","observation_id":"b48a26a1-8fed-4913-b31a-819a0130acb0","resolution":{"observed_at":"2026-08-01T02:43:24.424764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.05485","last_updated":"2026-04-07T06:25:49Z","snapshot_observed_at":"2026-07-06T22:54:12.531121Z","submitted_at":"2026-04-07T06:25:49Z","title":"Auditable Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.05485","snapshot_observed_at":"2026-08-01T02:43:24.427810Z","title":"Auditable agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.427810Z"},"links":{"cited_paper":"/paper/2604.05485","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:967691abf6f062eb0d4da1e3ae84449a474b81c13e661eef10cb78a8d97b4038","observation_id":"b92a1314-4622-4363-9304-76ecd1f0775e","resolution":{"observed_at":"2026-08-01T02:43:24.427810Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.430985Z","title":"Agent audit: A security analysis system for LLM agent applications,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.430985Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:a85e5b1002ac7f4c6dac310e73e75d78c880458134c718aa3e976efaa39217f4","observation_id":"48b4a103-e437-4b03-bb7b-d4b1637d0ecd","resolution":{"observed_at":"2026-08-01T02:43:24.430985Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.433909Z","title":"JSON canonicalization scheme (JCS),","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.433909Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:88886bdd7ac178a66a8e65dd0d494a63029621135c932424dcd071e33e1f1d5a","observation_id":"0b823ec3-0b7a-4043-8ba5-7206228ce627","resolution":{"observed_at":"2026-08-01T02:43:24.433909Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-06T11:57:54.131809Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2606.22916","snapshot_observed_at":"2026-08-01T02:43:24.437055Z","title":"Intent-governed tool authorization for AI agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.437055Z"},"links":{"cited_paper":"/paper/2606.22916","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:bc3fa4a0c3c078f3bc2ec937f7a03c641816a4b79de7a3db50e8522fb267b63a","observation_id":"889e1901-795c-4aed-8869-f65b2837f1dd","resolution":{"observed_at":"2026-08-01T02:43:24.437055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.440196Z","title":"To trust or to think: Cognitive forcing functions can reduce overreliance on AI in AI-Assisted decision-making,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.440196Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:3b6403685bb00989b4cadc600b2a3025bb41f0a6ac4a75705d7a4ec5c821bf67","observation_id":"44635574-ed87-41ee-99d2-dc669a5f25ec","resolution":{"observed_at":"2026-08-01T02:43:24.440196Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.443194Z","title":"Crying wolf: An empirical study of SSL warning effectiveness,","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.443194Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:4c7fcba06ce533a7ebb23a736871432c8d697f539018fac2b32e0746225706ad","observation_id":"36b9d225-6749-4868-bc36-00a4604e4379","resolution":{"observed_at":"2026-08-01T02:43:24.443194Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.446007Z","title":"Guidelines for Human-AI interaction,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.446007Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:ede10114ec0ab5ddf491b83c6589cd9ff7d5026bb190602b5197e93338132129","observation_id":"2f9267a9-b8da-498d-9839-c33c470e550f","resolution":{"observed_at":"2026-08-01T02:43:24.446007Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.448942Z","title":"Explainable security,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.448942Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:034190156eaf446c09adf2dc015394df7037dea908a2ad7a2be4606963861069","observation_id":"79a844e1-04aa-409d-af1c-55737551824e","resolution":{"observed_at":"2026-08-01T02:43:24.448942Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.451918Z","title":"Towards explainable access control [BlueSky Paper],","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.451918Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:24ed11250a2bb51f56e3c161068c9eda5d689d313885600f6afaba279d4af89b","observation_id":"93087a73-a41e-4ee4-a334-ab858490967c","resolution":{"observed_at":"2026-08-01T02:43:24.451918Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.454854Z","title":"SmartAuth: User-centered authorization for the internet of things,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.454854Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:9c9152baec21cd3eb3e26ca9ca511d6ff737d025507d6b5931563aeedf0d89f7","observation_id":"d8283456-f77a-43d9-8edb-0be319dba038","resolution":{"observed_at":"2026-08-01T02:43:24.454854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.457964Z","title":"AWare: Preventing abuse of privacy-sensitive sensors via operation bindings,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.457964Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:f677a4b1c2b3a6da2af0bf0c14564e733fe26cfa07e9bce3cabb4ac7215b55cc","observation_id":"5892d669-93d4-4927-8266-e12852075377","resolution":{"observed_at":"2026-08-01T02:43:24.457964Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.461082Z","title":"Decision provenance: Harnessing data flow for accountable systems,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.461082Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:904ef0dd113b1224c8b214e2ed11bea5741286afa4b6442b674b65fe346b21d3","observation_id":"92cc9bb8-f2e2-4f13-ae0b-d9102364fe40","resolution":{"observed_at":"2026-08-01T02:43:24.461082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.464227Z","title":"ACCESSPROV: Tracking the provenance of access control decisions,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.464227Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:b9937492440c76b6eb025e7f642ccdb9f00416fc1223b2a8e991b26c1175e423","observation_id":"58b99851-2307-4081-99b6-9c54c7d3e4fd","resolution":{"observed_at":"2026-08-01T02:43:24.464227Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-07T19:59:01.081751Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-01T02:43:24.467196Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.467196Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:3b39a593ef1c633a30518c41dc04e3b3a832cd268d8a68241918e75ba127cd5f","observation_id":"8dd6cb4f-e480-4019-89b8-bfcc21f5ff7c","resolution":{"observed_at":"2026-08-01T02:43:24.467196Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-08-01T02:43:24.470393Z","title":"Securing AI agents with information-flow control,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.470393Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:1c85b8a2ea2a51c9ef22520bead57c3d1d2127950877c419548423d4bc0c2d15","observation_id":"1fe5df0a-f9df-4553-89ca-46a108e0a5e3","resolution":{"observed_at":"2026-08-01T02:43:24.470393Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.473769Z","title":"Securing agents with tracked capabilities,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.473769Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:1de7678f35ec14d8bce80d2be417f776d6c628715008521125b07332ce0d6c35","observation_id":"972b83f8-82d8-4ab2-bf0e-d848e20dfd4a","resolution":{"observed_at":"2026-08-01T02:43:24.473769Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.476635Z","title":"AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.476635Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:523244ddd5339626f2cd90a20fa5281edac8a7f7c9a17b078078497bdc4ab017","observation_id":"0f7f09be-02bd-42bf-9e67-f1b0cc3bbc2f","resolution":{"observed_at":"2026-08-01T02:43:24.476635Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.479481Z","title":"Towards verifiably safe tool use for LLM agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.479481Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:7d33cbd3435b56c0a9b3c3640f11e8e033b00fa15f120ad8452e0c58db8b3a11","observation_id":"1077a7db-9985-4860-b4de-c635c5cddfec","resolution":{"observed_at":"2026-08-01T02:43:24.479481Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T02:43:24.395876Z","title":"Available: https://openreview.net/forum?id=GEcwtMk1uA","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.395876Z"},"links":{"citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:e8b0f1c93b829444a0a2ae1c3af843ecb2b071076ff3c47e863000ae12027de6","observation_id":"918492e6-a78d-40df-b636-7d4301aef83b","resolution":{"observed_at":"2026-08-01T02:43:24.395876Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","latest_version":2,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales"},"reference_resolution":{"displayed":42,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":42,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":42},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 42 of 42 outbound references and 0 inbound Pith citation observations for arXiv:2607.25364."}