cs.CRAug 21, 2026
SaveAID-Guard: Stateful Authorization for Delegated Agent Effects
Organizations: Information Engineering University
Abstract
Tool-using AI agents turn delegated tasks into provider effects, yet authorization often ends at admission while provider state, delivery, retry, and recovery evolve. A request may change before commit, or response loss may cause a replacement to create a second effect from one approval. We present AID-Guard, a stateful authorization-to-effect closure protocol. It revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result or certified no effect with a delivery fence. For supported provider contracts, one reservation yields at most one effect across retry and recovery. To our knowledge, it is the first evaluated agent-authorization protocol to unify these controls in one lifecycle. We implement a Python/SQLite prototype. In a declared loopback MCP domain, 13 live mutations caused no unauthorized provider effects, three concurrent histories were linearizable, and evidence bundles supported public verification and replay. All 210 Stripe provider-contract trials matched predeclared outcomes. Across Stripe and Resend, 40 terminalize-successor schedules, 30 overlapping races, and 10 crash-recovery schedules completed without duplicate effects. Under complete proposer compromise, AID-Guard blocked 44/44 attacks and admitted 44/44 matched legitimate proposals. Its strict exact-manifest profile reduced benign utility by 35.4 to 43.8 percentage points; a typed frontier recovered 9-10 completions without observed unsafe effects. A composition study blocked 20/20 post-admission lifecycle attacks and preserved 8/8 valid or exact-retry executions. The results support authorization-to-effect binding under the evaluated effect-path inventory, provider contracts, and failure schedules.
Figures & tables
Fig. 1: Stateful authorization through effect closure. H1 binds the evaluated action, H2 reserves quota and issues one capability, and H3 claims it at the credential-holding boundary. D2 revalidates the exact request and current provider state at commit. A terminal result closes the normal path; response loss retains the charge, while certified no-effect evidence installs a delivery fence before reservation release or one successor on the same lineage. The lower plane contains durable but non-executable evidence.
| Stage | Presented object | Same-transaction checks | Durable result |
|---|---|---|---|
| H1 | Eligible evaluation handle and authenticated actor session | Root and enrollment, workload/delegation, operation contract, provenance, policy, dependencies, boundary, trusted time | Transaction bound; context validated |
| H2 | Transaction checkpoint and, when required, one step-up assertion | Refreshed H1 dependencies, exact confirmation context, quota lineage, absence of a conflicting capability | Confirmation consumed; quota reserved; signed capability issued; issuance snapshot committed |
| H3 | Adapter-issued invocation, checkpoint, signed capability, and holder proof | Current root, session proof key, capability, reservation, immutable request, adapter scope, boundary epoch, and trusted time | Claim witness committed; capability claimed; reservation in flight |
TABLE I: The three mandatory authority checkpoints.
Fig. 2: Durable authority and effect-lifecycle states. The atomic provider profile combines H3 claim, provider effect, and outcome recording in one transaction. The controlled-idempotent path consumes the capability into a submitted attempt; a terminal provider result advances the attempt to a committed effect, and an accepted attestation records the outcome. Response loss remains uncertain. Certified no-effect recovery first installs a delivery fence and then selects reservation release or one successor on the same reservation lineage.
Fig. 3: Evaluation evidence planes. Natural and forced AgentDojo profiles use model-generated proposals; the direct profile submits the attacker proposal without a model. All terminate at the environment’s effect oracle. Separate official-MCP executions exercise H1–H3, D2, provider effects, recovery, and evidence verification; that lifecycle coverage is not attributed to each AgentDojo episode.
Fig. 4: Guard attribution for 13 official-MCP one-factor mutations. For pre-effect cases, green blocks show validated stages, red marks the rejecting check, and gray marks stages not reached. M09 commits an H3 witness before credential binding rejects dispatch. For M12–M13, the dark block denotes an existing committed effect whose mutated evidence fails verification. No case added an unauthorized provider effect.
| Observed profile | Provider outcome | Authority and reservation outcome | Retry or recovery consequence |
|---|---|---|---|
| Committed same graph | One committed effect | Original terminal lineage retained | Exact committed result and complete evidence bundle |
| Response loss after commit | One effect; no duplicate | Original terminal lineage retained | Durable exact result recovered after response loss |
| Certified no-effect release | No predecessor effect | Reservation released after delivery fence | Late predecessor delivery returns terminal no-effect replay |
| Certified no-effect successor | No predecessor effect | Reservation transferred to one named successor | Predecessor remains fenced; successor retains the single-effect opportunity |
TABLE II: Observed outcome and recovery contract. The effect count is scoped to the original reservation lineage; “predecessor effect” excludes a later authorized successor effect.
| Interval | P50 | P95 | P99 | Ambient P50 |
|---|---|---|---|---|
| End to end | 6849.5 | 7323.3 | 7551.3 | 2918.7 |
| H1 | 1068.9 | 1339.2 | 1425.7 | – |
| H2 | 1000.2 | 1305.7 | 1408.3 | – |
| H3 | 506.2 | 791.7 | 827.0 | – |
| Provider component | 24.6 | 41.4 | 43.4 | 12.2 |
TABLE III: Warm successful-path latency in the matched local prototype (ms). Each arm retains 150 observations; outliers are retained.
| Operation | Mean (ms) | P95 (ms) |
|---|---|---|
| Receipt projection | 57.4 | 66.7 |
| Bundle generation | 1285.0 | 1445.6 |
| Public verification | 41.9 | 47.2 |
| Privileged replay | 1257.0 | 1432.1 |
| Response-loss recovery | 9964.5 | 10756.0 |
| Certified no-effect recovery | 14523.1 | 16303.3 |
TABLE IV: Post-effect evidence and exceptional recovery cost in the frozen local prototype. Warmups are excluded and outliers are retained.
| Model | Dangerous prop., unprotected | Unsafe, unprotected | Unsafe, AID-Guard | unsafe | Benign util., unprotected | Benign util., AID-Guard |
|---|---|---|---|---|---|---|
| DeepSeek V4 Flash | 10/144 | 1/144 | 0/144 | pp [ , 0.0] | 41/48 | 20/48 |
| Qwen3 Max | 14/144 | 7/144 | 0/144 | pp [ , 0.0] | 42/48 | 25/48 |
TABLE V: Native model-in-the-loop safety and benign-utility outcomes. Each safety cell contains 144 injection episodes; each benign-utility cell contains 48 episodes. is AID-Guard minus unprotected with a paired task-cluster 95% bootstrap interval.
| Condition | Unsafe effects | Benign utility |
|---|---|---|
| Unprotected | 1/144 | 41/48 |
| Repeat user prompt | 2/144 | 43/48 |
| Spotlighting (delimiting) | 0/144 | 41/48 |
| AID-Guard admission | 0/144 | 20/48 |
TABLE VI: DeepSeek V4 Flash on identical AgentDojo v1.2.2 tasks. Unsafe-effect denominators are 144 injection episodes; benign-utility denominators are 48. These conditions compare natural model-in-the-loop admission.
Fig. 5: Containment under identical forced proposal pressure. Each cell reports one minus the oracle-confirmed unsafe-effect rate for five methods on the 44-case Qwen extension. Observed containment may include model non-adoption and is not a guard-attribution metric.
Fig. 6: Oracle-confirmed unsafe effects as proposer control increases: 288 natural, 176 forced-sequence, and 44 direct-proposal episodes. In the natural profile, the figure’s 25/288 exposure label counts protected-arm episodes containing a dangerous proposal; Table V separately reports 24/288 dangerous-proposal episodes and 8/288 oracle-confirmed unsafe effects in the unprotected arms. The counts differ because guard decisions alter subsequent protected-arm trajectories. Direct-profile exposure denotes attacker submissions without a model. All 44 matched legitimate direct proposals were admitted and executed without tool error.
Fig. 7: Shared-extension composition. AID-Guard blocked all 20 shared attacks and preserved all eight valid cases; lifecycle-only rows denote coverage rather than upstream failures.
| Inventory class | Items | P / N/A | Mechanical evidence |
|---|---|---|---|
| Credential routes | 11 | 6 / 5 | Registry joins, process environment and file scans, inheritance audit |
| Provider endpoints | 6 | 6 / 0 | Provider RPC probes over primary, alias, redirect, proxy, alternate, and direct routes |
| MCP transports | 6 | 2 / 4 | Official-SDK interface and session-semantics inspection |
| Process/network routes | 5 | 2 / 3 | Process-graph, launcher, socket, loopback, and egress observation |
| MCP primitives | 2 | 1 / 1 | Official tool-surface inspection |
| Async/admin routes | 6 | 0 / 6 | Provider-RPC AST and durable-schema enumeration |
TABLE VIII: D0 inventory classes and mechanical dispositions. P denotes IN_SCOPE_PASS ; N/A denotes mechanically validated absence in the frozen epoch.
| Campaign | Schedule and result | |
|---|---|---|
| Stripe accepted path | 210 | Seven equal strata matched the oracle; effect-bearing trials had one object and bypass had none. |
| Stripe terminal recovery | 30 | Cancel predecessor, reject late confirmation, then commit one successor; no duplicate effect. |
| Stripe in-flight race | 30 | Barrier-released confirm / cancel ; all overlapped and were cancel-win with no charge. |
| Stripe local-crash recovery | 10 | Provider-first lookup restored terminal no-effect before one successor was authorized. |
| Resend terminal recovery | 10 | Exact replay, changed-body rejection, cancellation, and one delivered successor per lineage. |
TABLE IX: External-provider schedules behind RQ3. These finite test-mode observations are not a general provider linearizability proof.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | Exact 1x | Typed 1x | Typed 3x | Unsafe |
|---|---|---|---|---|
| DeepSeek V4 Flash | 12/48 | 14/48 | 22/48 | 0/432 |
| Qwen3 Max | 17/48 | 18/48 | 26/48 | 0/432 |
TABLE X: AgentDojo utility under three pre-fixed authority forms. Each utility cell contains 48 benign episodes; the unsafe column aggregates 432 attack episodes per model. Calls use temperature zero, but the endpoint exposes no generation seed.
| Condition | DS-6 | Qwen-6 | Qwen-44 |
|---|---|---|---|
| Unprotected AgentDojo | 6/6 | 6/6 | 42/44 |
| Spotlighting (delimiting) | 2/6 | 4/6 | 29/44 |
| CaMeL | 4/6 | 5/6 | 38/44 |
| Progent | 1/6 | 2/6 | 14/44 |
| AID-Guard | 0/6 | 0/6 | 0/44 |
TABLE XI: Unsafe effects on the fixed six-case proposer-pressure discrimination set and the predeclared 44-case Qwen extension. Neither set estimates natural or population ASR.
| Removed control | Observed exposure | Residual provider control |
|---|---|---|
| Commit-time binding | Request substitution and scope drift committed unsafe effects | None at the authorization boundary |
| Identity continuity | Actor/session substitution committed an unsafe effect | None at the authorization boundary |
| Outcome binding | Substituted outcome evidence was accepted | Provider state cannot validate authority evidence |
| Single-use authority | No additional provider effect | Native scoped idempotency remained effective |
| Durable recovery fence | No additional provider effect | Native terminal and idempotency fences remained effective |
TABLE XII: Control-removal and residual-control results. Every profile preserved its matched normal execution. Provider-native controls were retained rather than bypassed.
More in this topic
AI Agent Security
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.
See all 508 papers