REVIEW 3 major objections 6 minor 46 references
An evolving agent may change active authority only beneath a fixed effect ceiling the user set at grant time; mutation cannot raise that ceiling.
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · grok-4.5
2026-07-30 18:11 UTC pith:MMFZWGR2
load-bearing objection Clean formal split between grant survival and a fixed ceiling; the theorem holds, but deployability mostly hangs on an open monitor-view problem the authors already flag. the 3 major comments →
Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Authorization for evolving agents must separate continuity from containment. A grant survives only mutations inside a fixed transition envelope; active authority may contract freely and expand only under evidence, but always clamped to an immutable effect ceiling fixed at grant time. Under the stated runtime assumptions, mutation cannot amplify protected effects beyond that user-issued ceiling, and agent-produced evidence cannot raise it.
What carries the argument
State-bound authorization: a grant-fixed transition envelope (whether the grant stays alive) plus an immutable effect ceiling B, with active authority Pt = Pprop_t ∩ B. Non-amplification (Theorem 1 / Appendix Theorem 3) then shows every protected effect stays inside some user-issued root ceiling.
Load-bearing premise
The monitor’s view of the agent must never understate what the agent can actually do; if it misses a mutation or under-approximates reachable effects, the safety bound fails even when every other check passes.
What would settle it
Replay long-running agent tasks across controlled mutations (memory, tools, phase, delegation, enforcement) and measure whether any admitted action realizes a protected effect outside the original user ceiling, or whether a grant remains active after a transition the envelope should have suspended.
If this is right
- Earned-autonomy ladders are safe only if they terminate under a ceiling that performance evidence cannot move.
- Tool-manifest binding alone is insufficient: phase, control-state, delegation, and enforcement changes can stale a grant without changing the tool list.
- Child agents must receive attenuated authority bound to the delegated subtask, not the parent’s full ceiling.
- Systems can treat competence signals as reliability allocation below the ceiling without treating them as an adversarial security bound.
- Six mutation classes give a concrete checklist for what monitors must observe and when to continue, contract, suspend, or reauthorize.
Where Pith is reading between the lines
- Product defaults will likely need preset ceilings and phase gates (draft vs send, test vs deploy) because users will not hand-author effect sets for every session.
- The open problems of sound envelopes and computable over-approximations of effective authority are the main engineering bottleneck between the theorem and deployable monitors.
- Cross-generation and multi-agent settings will need revocation lineage on top of this per-grant ceiling model, or authority can reappear in descendants the user never re-evaluated.
- If monitors cannot observe hot-reloads and persistent memory writes, real systems will look like the paper’s necessity construction: mechanically valid grants with unbounded out-of-scope effects.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper formalizes "authorization continuity" for long-lived, self-evolving agents: when does a grant survive mutation of the agent or its context, how may active authority change, and what boundary is immovable. The model fixes a transition envelope M and an immutable effect ceiling Lmax at grant time; beneath the ceiling, descent is free and ascent is evidence-gated, with all proposals clamped (Def. 5, Eq. 11). The main results are a compact non-amplification theorem (Thm 1: Eff ⊆ Req ⊆ Pt ⊆ B) and a structured counterpart (Thm 3, proved in App. G) deriving containment in user-issued root ceilings from complete mediation, a closure-sound monitor view (A2), single-lease attribution, attenuating delegation, and monitor integrity. Proposition 7 shows (A2) is necessary; Propositions 4–6 characterize when evidence gates tighten the bound below the ceiling and price systems that let performance evidence raise the ceiling itself. Six mutation classes are mapped to authorization consequences.
Significance. If the results hold — and the core induction appears sound — the paper makes a clean, well-stratified contribution: it separates a security boundary (the ceiling) from a reliability mechanism (the evidence gate) and proves, via Corollary 1 and Proposition 6, that the ceiling bound is evidence-independent by construction. This "separation obligation" (Def. 8) is a falsifiable design rule that directly prices earned-autonomy ladders in the practitioner literature. The necessity construction (Prop. 7) is genuinely informative: it identifies observability of mutation, not policy enforcement, as the first thing to measure in deployed systems. The assumption ledger is honest — no free parameters, each of (A1)–(A5) does named work, and the limitations (halting-problem subsumption of A, compositional drift, ceiling placement) are stated rather than hidden. The requested/realized effects distinction and the phase-only need-change witness (Prop. 3) are the right formal objects for the motivating problem.
major comments (3)
- [App. B, Remark 6; Def. 12 group (ii); §VIII] The deployable content of Theorem 3 rests on the per-admission check A#(Ŝt,L) ⊆ Scope(L) with a sound computable A#. Remark 6 concedes that A subsumes the halting problem once a lease permits shell execution, but the paper should state the sharper consequence explicitly: for any lease permitting arbitrary code execution over granted resources — the normal case for the coding agents that motivate the paper — a sound computable A# must over-approximate OS-level reachability under L, so the check either rejects near-universally (degenerating to per-action grants) or is implemented with an under-approximating A#, which is exactly the configuration Proposition 7 shows fails without bound. Please characterize the class of deployments that escapes this dichotomy (e.g., sandboxed effect universes where OS-level reachability under L coincides with Scope(L), syscall-mediated runtimes, or leases th
- [Appendix opening, Eq. (4); Thm 1 vs Thm 3] The claim that Theorem 3 'refines' Theorem 1 through 'different effect-soundness interfaces' is asserted but not made precise. Theorem 1's premise is request soundness, Eff(St,a) ⊆ Req(a) (Eq. 1); Theorem 3 never uses or recovers this — its chain is Eff ⊆ A ⊆ A# ⊆ Scope(L), and group (i) only checks Req(a) ⊆ Scope(L). So in the structured model an admitted action may realize effects strictly larger than its monitor-verified request, and Eq. (1) can fail while Theorem 3 still holds. This matters because the abstract advertises the requested/realized distinction as a contribution. Please state the exact logical relationship: does (A2) plus group (i) imply Eq. (1), are the two premise sets incomparable, and under what additional condition (e.g., Req required to list all realizable effects of a) does the structured model instantiate the compact one?
- [App. C, Def. 11 and Remark 9] Envelope soundness (Def. 11) quantifies over all states reachable via M with the undecidable closure A, and Remark 9 concedes it is 'the principal open problem,' with the runtime falling back to the per-admission A# check. As written, the syntactic PathCompat condition therefore contributes no independent security content beyond a pre-filter: everything protective flows through the same A#/(A2) channel as the ceiling guard, which is in tension with the 'two envelopes, two guards' framing of Remark 8 and Figure 2. Please either exhibit a non-trivial class of envelopes provably sound under a stated restriction (e.g., labels that provably do not change c_t or e_t), or reframe the envelope's role explicitly as liveness/continuity bookkeeping whose security weight is carried entirely by the closure check.
minor comments (6)
- [Def. 12] DelegCompat(d_t, D) appears in group (ii) but is never defined in the text; please give the predicate or a forward reference. Similarly, Fresh(L, t) references revocation and suspension, but no revocation mechanism is modeled — a sentence clarifying who may revoke and how the monitor learns of it would help.
- [Eq. (10), Def. 4] Need is defined via monitor-verified requests Req(a), so 'authority need' is relative to the request abstraction rather than to realized effects. Given the paper's own emphasis on the requested/realized gap, one sentence noting this dependence would prevent misreading.
- [App. B5, Remark 5] The decay rule is acknowledged as what 'makes elasticity worth implementing at all,' yet it appears only in a remark deep in the appendix. Since the main-text narrative (§V-A, Fig. 1) sells conditional ascent, the decay requirement should be surfaced in §V-A.
- [Assumption 2 / Remark 11] Single-lease attribution is stated as an assumption, but the enforcement mechanism is unclear when an action is independently valid under several live leases — which lease does the monitor attribute, and can the agent choose? A brief discussion of the attribution rule would strengthen the confused-deputy motivation.
- [App. G] The cross-reference 'Appendix G0e' appears to be a typo or broken label. Also, Proposition 3's argument is labeled 'Construction' — calling it a proof sketch with constructive witnesses would be more standard.
- [Throughout] Typographical artifacts suggest proof issues: 'formulateauthorization', 'useevolution', 'V oyager', 'G¨odel', 'G ¨odel', 'OW ASP'. Please check the compiled PDF. In Table II, the 'Earned-autonomy ladder' row should cite the specific frameworks [31]–[34] it characterizes.
Circularity Check
No significant circularity: non-amplification is a standard soundness theorem for an explicitly constructed clamp-and-monitor model, not a fitted or self-defined prediction.
full rationale
The paper proposes a state-bound authorization model (fixed ceiling B / Lmax, transition envelope M, evidence-gated ascent beneath the ceiling) and proves that under stated runtime assumptions the model meets its own security goal. Equation 2 and Definition 5 make Pt ⊆ B and Lt ⪯ Lmax true by the clamp; Theorem 1/3 then lifts that containment to realized effects via complete mediation, request/closure soundness, attenuating delegation, and monitor integrity. That is ordinary mechanism soundness, not a circular derivation: the interesting obligations are the assumptions (especially A2), which the paper treats as premises and shows are necessary (Proposition 7), not as consequences smuggled from the claim. Reach/U∞ is defined as a least escalation closure and Theorem 2 is an induction inside that definition—standard fixed-point reasoning. Corollary 1’s independence of ⊢ is an intentional layering result, openly noted. There is no data fitting, no parameter tuned then re-predicted, no load-bearing uniqueness theorem from overlapping authors, and no renaming of an external empirical law. Self-citations in the bibliography are to the authors’ prior adversarial-ML work and are not used to justify the authorization theorems. Score 0.
Axiom & Free-Parameter Ledger
axioms (8)
- domain assumption Complete mediation: every protected effect is produced only by a monitor-admitted action (A1).
- ad hoc to paper Closure-sound monitor view: A(St,L) ⊆ A#(Ŝt,L) at each admission (A2); labels need not recover full state.
- domain assumption Attenuating delegation with finite depth: Lchild ⪯ Lparent ⊓ Lsubtask (A4).
- domain assumption Monitor integrity: agent cannot modify monitor, lease store, or log except via higher-authority path (A5).
- ad hoc to paper Single-lease attribution: each action draws on exactly one live lease; leases are not combined (Assumption 2).
- domain assumption Request soundness Eff(St,a) ⊆ Req(a) at admission (Eq. 1) / sound effect abstraction.
- standard math Goals/phases form a meet-semilattice under refinement ⊑g so lease meet is well-defined (Proposition 1).
- domain assumption Sound (possibly incomplete) semantic oracle Ω for goal and phase (Assumption 1).
invented entities (4)
-
Transition envelope M / PathCompat
no independent evidence
-
Immutable effect ceiling Lmax / B
no independent evidence
-
Escalation closure U∞ and permission bound Reach
no independent evidence
-
Authority need Need(St,qt) as a family of effect bounds
no independent evidence
read the original abstract
Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. This improves adaptation but creates a distinct authorization problem. Tool-enabled agents can turn model errors and prompt injections into consequential external actions; when evolution occurs under a live grant, the subject exercising that authority or the context in which it acts may no longer match what the user evaluated. Evolution can change both the effects reachable under an old grant and the authority required by the task, which may rise, fall, or become incomparable. Existing tool policies constrain actions but do not determine when a grant survives this change. We formulate authorization continuity: when does an existing grant remain valid, how may active authority change, and what boundary must never move? Our state-bound model fixes a transition envelope and an immutable effect ceiling at grant time. The envelope determines whether the grant survives a mutation; below the ceiling, authority may contract freely and expand only under specified evidence conditions. We distinguish requested from realized effects and prove that, under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling. Agent-produced evidence may allocate authority below the ceiling but cannot raise it. Finally, we map six mutation classes to their authorization consequences.
Figures
Reference graph
Works this paper leans on
-
[1]
H.-a. Gao, J. Geng, W. Huaet al., “A survey of self-evolving agents: What, when, how, and where to evolve on the path to artificial super intelligence,”arXiv preprint arXiv:2507.21046, 2025, version 4, January 2026; 28 authors, list abbreviated
Pith/arXiv arXiv 2025
-
[2]
Lifelong learning of large language model based agents: A roadmap,
J. Zheng, C. Shi, X. Cai, Q. Li, D. Zhang, C. Li, D. Yu, and Q. Ma, “Lifelong learning of large language model based agents: A roadmap,” arXiv preprint arXiv:2501.07278, 2025
arXiv 2025
-
[3]
Reflexion: Language agents with verbal reinforcement learning,
N. Shinn, F. Cassano, E. Berman, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language agents with verbal reinforcement learning,” arXiv preprint arXiv:2303.11366, 2023
Pith/arXiv arXiv 2023
-
[4]
ExpeL: LLM agents are experiential learners,
A. Zhao, D. Huang, Q. Xu, M. Lin, Y .-J. Liu, and G. Huang, “ExpeL: LLM agents are experiential learners,”arXiv preprint arXiv:2308.10144, 2023
Pith/arXiv arXiv 2023
-
[5]
V oyager: An open-ended embodied agent with large language models,
G. Wang, Y . Xie, Y . Jiang, A. Mandlekar, C. Xiao, Y . Zhu, L. Fan, and A. Anandkumar, “V oyager: An open-ended embodied agent with large language models,”arXiv preprint arXiv:2305.16291, 2023
Pith/arXiv arXiv 2023
-
[6]
Automated design of agentic systems,
S. Hu, C. Lu, and J. Clune, “Automated design of agentic systems,” arXiv preprint arXiv:2408.08435, 2024
Pith/arXiv arXiv 2024
-
[7]
G ¨odel agent: A self-referential agent framework for recursive self-improvement,
X. Yin, X. Wang, L. Pan, L. Lin, X. Wan, and W. Y . Wang, “G ¨odel agent: A self-referential agent framework for recursive self-improvement,” arXiv preprint arXiv:2410.04444, 2024
Pith/arXiv arXiv 2024
-
[8]
Darwin g ¨odel machine: Open-ended evolution of self-improving agents,
J. Zhang, S. Hu, C. Lu, R. Lange, and J. Clune, “Darwin g ¨odel machine: Open-ended evolution of self-improving agents,”arXiv preprint arXiv:2505.22954, 2025, revised March 2026
Pith/arXiv arXiv 2025
-
[9]
Evaluating membership inference through adversarial robustness,
Z. Zhang, L. Yu Zhang, X. Zheng, B. Hussain Abbasi, and S. Hu, “Evaluating membership inference through adversarial robustness,”The Computer Journal, vol. 65, no. 11, pp. 2969–2978, 2022
2022
-
[10]
Self-supervised adversarial example detection by disentangled representation,
Z. Zhang, L. Y . Zhang, X. Zheng, J. Tian, and J. Zhou, “Self-supervised adversarial example detection by disentangled representation,” in2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 2022, pp. 1000– 1007
2022
-
[11]
Stealing watermarks of large language models via mixed integer programming,
Z. Zhang, X. Zhang, Y . Zhang, L. Y . Zhang, C. Chen, S. Hu, A. Gill, and S. Pan, “Stealing watermarks of large language models via mixed integer programming,” in2024 Annual Computer Security Applications Conference (ACSAC). IEEE, 2024, pp. 46–60
2024
-
[12]
Exploring gradient-guided masked language model to detect textual adversarial attacks,
X. Zhang, Z. Zhang, Y . Zhang, X. Zheng, L. Y . Zhang, S. Hu, and S. Pan, “Exploring gradient-guided masked language model to detect textual adversarial attacks,”IEEE Transactions on Audio, Speech and Language Processing, vol. 34, pp. 1763–1774, 2026
2026
-
[13]
Character-level perturbations disrupt llm watermarks,
Z. Zhang*, X. Zhang*, Y . Zhang, H. Zhang, S. Pan, B. Liu, A. Q. Gill, and L. Y . Zhang, “Character-level perturbations disrupt llm watermarks,” inNetwork and Distributed System Security (NDSS) Symposium 2026, 2026
2026
-
[14]
X. Zhang, Z. Zhang, L. Y . Zhang, Y . Zhang, G. Tao, and S. Pan, “Less is more–until it breaks: Security pitfalls of vision token compression in large vision-language models,”arXiv preprint arXiv:2601.12042, 2026
arXiv 2026
-
[15]
Design patterns for securing llm agents against prompt injections,
L. Beurer-Kellner, B. Buesser, A.-M. Cre t ¸u, E. Debenedetti, D. Dobos, D. Fabian, M. Fischer, D. Froelicher, K. Grosse, D. Naeff, E. Ozoani, A. Paverd, F. Tram `er, and V . V olhejn, “Design patterns for securing llm agents against prompt injections,”arXiv preprint arXiv:2506.08837, 2025
Pith/arXiv arXiv 2025
-
[16]
Defeating prompt injections by design,
E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tram `er, “Defeating prompt injections by design,”arXiv preprint arXiv:2503.18813, 2025
Pith/arXiv arXiv 2025
-
[17]
Insights into ai agent security from a large-scale red-teaming competition,
National Institute of Standards and Technology, “Insights into ai agent security from a large-scale red-teaming competition,” CAISI Research Blog, https://www.nist.gov/blogs/caisi-research-blog/insights-ai-agent- security-large-scale-red-teaming-competition, 2026, published 23 March 2026; conducted with Gray Swan and the UK AI Security Institute; snapshot...
2026
-
[18]
On safety risks in experience-driven self-evolving agents,
W. Zhao, Y . Zhang, Y . Wang, Y . Deng, Y . Zhao, X. Zhi, Y . Huang, H. He, W. Che, B. Qin, and T. Liu, “On safety risks in experience-driven self-evolving agents,”arXiv preprint arXiv:2604.16968, 2026
Pith/arXiv arXiv 2026
-
[19]
Oep: Poisoning self-evolving llm agents via locally correct but non-transferable experiences,
K. Wang, J. Lou, Z. Zhou, and J. Li, “Oep: Poisoning self-evolving llm agents via locally correct but non-transferable experiences,”arXiv preprint arXiv:2605.18930, 2026
Pith/arXiv arXiv 2026
-
[20]
Dynamic malicious skills in agentic ai,
T. Chen, Z. Jiang, Y . Hu, Y . Gou, and N. Z. Gong, “Dynamic malicious skills in agentic ai,”arXiv preprint arXiv:2606.16287, 2026
Pith/arXiv arXiv 2026
-
[21]
P. Dash, T. Ge, A. Jain, T. Shah, and Z. Shang, “From untrusted input to trusted memory: A systematic study of memory poisoning attacks in llm agents,”arXiv preprint arXiv:2606.04329, 2026
Pith/arXiv arXiv 2026
-
[22]
Z. Zhou, “Governing dynamic capabilities: Cryptographic binding and reproducibility verification for ai agent tool use,”arXiv preprint arXiv:2603.14332, 2026
arXiv 2026
-
[23]
The protection of information in computer systems,
J. H. Saltzer and M. D. Schroeder, “The protection of information in computer systems,”Proceedings of the IEEE, vol. 63, no. 9, pp. 1278– 1308, 1975
1975
-
[24]
Options, not clicks: Lattice refinement for consent-driven mcp authorization,
Y . Li, Y . Chen, P. Wang, I. Khabra, F. H. Shezan, Y . Feng, and Y . Tian, “Options, not clicks: Lattice refinement for consent-driven mcp authorization,”arXiv preprint arXiv:2605.11360, 2026
Pith/arXiv arXiv 2026
-
[25]
Progent: Securing ai agents with privilege control,
T. Shi, J. He, Z. Wang, H. Li, L. Wu, W. Guo, and D. Song, “Progent: Securing ai agents with privilege control,”arXiv preprint arXiv:2504.11703, 2025, revised 2026; earlier versions titled “Progent: Programmable Privilege Control for LLM Agents”
Pith/arXiv arXiv 2025
-
[26]
T. Zhou, L. D’Antoni, and N. Polikarpova, “Language-based agent control,”arXiv preprint arXiv:2605.12863, 2026
Pith/arXiv arXiv 2026
-
[27]
Skillguard: A permission-centric framework for agent skill security,
S. Pan, X. Sun, T. Zhang, D. Liao, K. Yang, and Z. Xing, “Skillguard: A permission-centric framework for agent skill security,”arXiv preprint arXiv:2606.03024, 2026
Pith/arXiv arXiv 2026
-
[28]
Your agent may misevolve: Emergent risks in self-evolving llm agents,
S. Shao, Q. Ren, C. Qian, B. Wei, D. Guo, J. Yang, X. Song, L. Zhang, W. Zhang, D. Liu, and J. Shao, “Your agent may misevolve: Emergent risks in self-evolving llm agents,”arXiv preprint arXiv:2509.26354, 2025, version 2, March 2026
arXiv 2025
-
[29]
Owasp agentic skills top 10 (ast10),
OW ASP Foundation, “Owasp agentic skills top 10 (ast10),” https://owasp. org/www-project-agentic-skills-top-10/, 2026, version 1.0-2026, March 2026; snapshot accessed 2026-07-26
2026
-
[30]
Safety in self-evolving llm agent systems: Threats, amplification, and case studies,
R. Lin, X. Deng, Q. Li, J. Ma, Y . Feng, Y . Qing, Z. Li, Y . Zhang, S. Cui, C. Meng, T. Zhang, X. Ma, Q. Li, K. Xu, and S. Ji, “Safety in self-evolving llm agent systems: Threats, amplification, and case studies,” arXiv preprint arXiv:2606.23075, 2026
Pith/arXiv arXiv 2026
-
[31]
Four security principles for agentic ai systems,
Amazon Web Services, “Four security principles for agentic ai systems,” AWS Security Blog, https://aws.amazon.com/blogs/security/four-security- principles-for-agentic-ai-systems/, 2026, documentation snapshot ac- cessed 2026-07-26
2026
-
[32]
Ai agent governance, part 2: Governing ai agents in practice,
KnowBe4, “Ai agent governance, part 2: Governing ai agents in practice,” KnowBe4 Blog, https://blog.knowbe4.com/ai-agent-governance-part-2- what-good-looks-like-governing-ai-agents-in-practice, 2026, practitioner commentary; snapshot accessed 2026-07-26
2026
-
[33]
The agentic trust framework: Zero trust governance for ai agents,
J. Woodruff, “The agentic trust framework: Zero trust governance for ai agents,” Cloud Security Alliance, https://cloudsecurityalliance.org/blog/2026/02/02/the-agentic-trust- framework-zero-trust-governance-for-ai-agents, 2026, published 2 February 2026; snapshot accessed 2026-07-26
2026
-
[34]
Leveling up autonomy in agentic ai,
J. Reavis, “Leveling up autonomy in agentic ai,” Cloud Secu- rity Alliance, https://cloudsecurityalliance.org/blog/2026/01/28/levels-of- autonomy, 2026, published 28 January 2026; snapshot accessed 2026- 07-26
2026
-
[35]
Deontic policies for runtime governance of agentic ai systems,
A. Joshi, T. Finin, K. P. Joshi, and L. Kagal, “Deontic policies for runtime governance of agentic ai systems,”arXiv preprint arXiv:2606.19464, 2026
Pith/arXiv arXiv 2026
-
[36]
Computer security technology planning study. volume 2,
J. P. Anderson, “Computer security technology planning study. volume 2,” Electronic Systems Division, Air Force Systems Command, Tech. Rep., 1972
1972
-
[37]
The confused deputy: (or why capabilities might have been invented),
N. Hardy, “The confused deputy: (or why capabilities might have been invented),”ACM SIGOPS Operating Systems Review, vol. 22, no. 4, pp. 36–38, 1988
1988
-
[38]
Open challenges in multi-agent security: Towards secure systems of interacting ai agents,
C. Schroeder de Witt, K. Krawiecka, I. Krawczuket al., “Open challenges in multi-agent security: Towards secure systems of interacting ai agents,” arXiv preprint arXiv:2505.02077, 2025, version 2, April 2026; 24 authors, list abbreviated
Pith/arXiv arXiv 2025
-
[39]
Announcing the “ai agent standards initiative
National Institute of Standards and Technology, “Announcing the “ai agent standards initiative” for interoperable and secure innovation,” Center for AI Standards and Innovation, https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent- standards-initiative-interoperable-and-secure, 2026, published 17 February 2026; snapshot accessed 2026-07-26
2026
-
[40]
Software and ai agent iden- tity and authorization,
National Cybersecurity Center of Excellence, “Software and ai agent iden- tity and authorization,” NIST NCCoE project page, https://www.nccoe. nist.gov/projects/software-and-ai-agent-identity-and-authorization, 2026, snapshot accessed 2026-07-26. APPENDIX This appendix instantiates the effect-set model with struc- tured resources, phases, budgets, mutatio...
2026
-
[41]
It is not
Why authority need moves:Before fixing a boundary we should say what it bounds, and in particular whether the authority an agent requires is stable across a session at all. It is not. The reason is worth separating from the security argument, because it is the premise on which the rest of the model rests. Definition 4(Authority need).Let Plan(St, qt) be t...
-
[42]
The authority ceiling:A single fixed lease is not what a user issuing a broad grant intends. The intent is better captured as:at grant time we fix a boundary and a tolerance for movement inside it; as the task proceeds and the agent’s instructions, tools, skills, and ingested context all change, the authority actually in force changes with them, but it mu...
-
[43]
Read one way, the gate is a security control that keeps authority below the ceiling; that reading fails whenever the agent can manufacture the evidence
A gate-dependent permission bound:Gated ascent is easy to misread in either direction. Read one way, the gate is a security control that keeps authority below the ceiling; that reading fails whenever the agent can manufacture the evidence. Read the other way, the gate is decoration; that reading fails too, and the difference between them turns on a single...
-
[44]
behavior- derived
ifU ∞ ⇝L ∗, thenL ∗ ⊓L max ∈ U∞. Its permission bound is Reach(Lmax, L0,⊢) = [ L∈U∞ Scope(L).(12) The full set {L:L⪯L max} satisfies the three conditions. The intersection of all sets satisfying them also does so because realizability is monotone under set inclusion, hence a least such set exists. The construction intentionally forgets which witnesses occ...
-
[45]
Why the evidence rule need not be adversarially robust: Proposition 4 reads at first like a negative result about earned authority, and much practitioner guidance, which holds that autonomy should be expanded progressively on demonstrated performance rather than granted by default, is vulnerable to exactly that reading. If competence evidence can be manu-...
-
[46]
these two agent states may share authority
Effective authority:Scope is a static notion. What we actually need to bound is everything an agent could achieve by chaining permitted actions, since a file-read tool and an outbound-network tool may each appear low risk while jointly enabling exfiltration. Definition 9(Effective-authority closure). A(S, L) = ϵ∈ E ϵis produced by a finite sequence o...
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.