cs.PLSep 18, 2026

Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution

Authors: Genliang Zhu, Chu Wang

Organizations: Accentrust, Vancouver, Canada · Georgia Institute of Technology, Atlanta, Georgia, USA · University of Illinois Urbana-Champaign, Urbana, Illinois, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Long-running AI agents outlive initiating processes through credentials, delegated tasks, queues, callbacks, reservations, and provider-side operations. Cancellation, process exit, and credential revocation neither close every pre-cut carrier nor distinguish independently authorized shared work. We define root-scoped authorization quiescence: for each manifested sink, a certificate accounts for every cut-relevant acceptance under the retired root-epoch atom that precedes its local fence and excludes protected acceptance under that atom after the fence, while permitting exact rebind to a current, independently sufficient support. The root-scoped quiescence protocol linearizes a root cut, fences old-root expansion and protected sinks, represents alternative and conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates into a cutset over registered old-root paths. Exact channel-token accounting reconciles transfers; missing or conflicting evidence remains indeterminate. Under stated assumptions, we prove post-cut issuer non-expansion, support-sound projection, compositional soundness under exact channel conservation, independent-support preservation, merge-order independence, and crash/replay stability. A provider-free late-effect test suite matches 17/17 registered outcomes. Two cancellation-only and one cut-only execution accept the same class of already scheduled late effect; two cut-plus-fence executions, one restart, and one stale-process execution reject it. A separately implemented checker verifies 17/17 traces and rejects 44/44 consistently rehashed semantic regressions. The certificate establishes root-relative authorization quiescence within its bound manifest and configuration, not global idleness, rollback, or business completion.

Figures & tables

Observation or mechanismWhat it establishesWhat remains for root-scoped quiescence
Cancellation acknowledgementa task endpoint accepted or attempted a cancellation-state transitionwhether underlying work, descendants, prepared effects, and transferred messages can still commit
Process exitone observed process terminatedwhether authority escaped into remote tasks, credentials, triggers, queues, or provider state
Token revocationa named token is no longer accepted under the issuer’s revocation semanticsderived credentials, cached authorization, already accepted work, and effects not mediated by that token
Exact delegation-edge revocationthe authority consequences of removing a selected graph edgeobligations and carrier effects already emitted before or across the revocation cut
Provider-local effect closureone adapter’s registered local frontier is closed at its fence and watermarkcompatible cut identity, complete provider coverage, and messages crossing between leaves
Closure-evidence verifiersubmitted evidence satisfies a declared closure predicateexecution of the root cut, provider actuation, and distributed collection of compatible leaf evidence
Table 1. Adjacent observations and the root-scoped quiescence decision.
IDAssumptionEnforced obligation
A1Issuer mediation and non-expansionEvery transition that issues, delegates, reactivates, or enlarges authority under a root crosses the manifested root issuer and validates the exact root-epoch atom at its root-ledger linearization point. This premise does not treat exercise by an already authorized carrier as a new issuance.
A2Authentic canonical evidenceGrants, root atoms, support records, cuts, manifests, fences, channel dispositions, rebind receipts, frontier statements, and certificates use unambiguous canonical encodings and unforgeable authenticators.
A3Durable root linearizationA cut retiring epoch ee , the advance to e+1e+1 , the phase transition, the frozen manifest, and the exact cut-target token frontier commit atomically in a serializable durable ledger; epochs never decrease and a retired atom is never reactivated. The root transaction does not itself install a provider fence.
A4Support-provenance completenessEvery carrier and handoff records all policy-relevant minimal authorization supports, the witness actually selected for its current authority, and authenticated parent-to-child provenance. Omission or ambiguity yields an unknown carrier.
A5Per-sink fence and frontier soundnessEvery manifested effect sink pp serializes commitment admission with a durable local barrier bp(c)b_{p}(c) . The barrier causally follows authenticated observation of cut cc , rejects every later local attempt selected under the retired atom, and yields a frontier that completely enumerates every cut-relevant acceptance under that atom that was outstanding when cc committed or was admitted from a dependent carrier before bp(c)b_{p}(c) , while closing each such commitment’s future-use, instance, and lineage frontier.
A6Registry and manifest completenessThe frozen manifest covers every runtime, provider, effect sink, and channel class reachable from work selected under the retired atom. Stable scans include all carrier creation and transition events through their stated watermarks.
Table 2. Assurance assumptions for a registered quiescence profile.
Figure 1. Protocol separation. The root cut retires issuer-side creation and expansion of old-epoch authority; adapter-specific barriers and frontier leaves establish local facts; exact cutset aggregation establishes the composed predicate; a separately implemented checker validates the evidence object. A two-level flow diagram. The top level moves from the root authority issuer through a durable epoch cut, support projection, leaf aggregation, and a root-scoped certificate. Runtime and provider adapters plus frontier barriers feed evidence upward, and a separate checker validates the final certificate.
Figure 2. Minimal-support antichains distinguish alternative from conjunctive authority. Dashed availability is not authorization until an atomic rebind selects it. On the left, roots A and B independently support one carrier; the A edge is selected and the B edge is merely available until rebind. On the right, A and B jointly support a carrier, so retirement of A leaves no sufficient witness.
Field groupBound factAcceptance condition
Identityprovider, adapter profile, key identity, schema versionadmitted and unambiguous
Cut headerroot, retired epoch, cut id, cut-record digestexact agreement across leaves
Coveragemanifest/configuration/graph-scope digests; covered ingress, frontier and channelsunion equals sealed manifest
Barrier evidencefence receipts, provider-local admission/barrier positions, log watermarkscausal observation of the cut and valid local ordering
Local stateopen carriers, generators, accepted operations, typed terminal dispositionsno known old-root live blocker; every cut-relevant old-atom pre-fence acceptance has its exact receipt
Transfer statetyped SEND and terminal ACK records with unique token mapsexact projected accounting; ACCEPT binds a covered destination carrier
Table 3. Logical leaf-certificate obligations.
EndpointPersistent carrierRequired barrier/evidenceNonpositive condition
MCP asynchronous tasktask state, provider work, descendantscut-bound cancel receipt, terminal query, descendant/transfer coverage, protected sink fencecooperative ack without terminal/frontier evidence
A2A delegated taskremote task, artifact, delegated childtask correlation, terminal or fence receipt, outbound child tokensunsupported cancel, missing child catalog, late artifact path
Credential issueraccess/refresh token and derived credentialsissuer tombstone/introspection, propagation bound, derived-token closureunknown derivation, cache bypass, untrusted expiry
Durable queue or triggermessage, retry, cron, webhook, generatoringress generation fence, gap-free watermark, accepted-message terminal receiptsforgotten generator, watermark gap, unfenced consumer
Effect reservation/gatewayreservation, prepare, settlementcutoff-aware reserve/commit gate and terminal/no-effect receiptambiguous prepare/commit, bypassable effect sink
Table 4. Endpoint correspondence contracts for conforming deployments.
Scenario groupCasesRegistered outcomeRegistered distinguishing fact
Cancellation acknowledgement only2baseline false-stoplate epoch-1 effect accepted after acknowledgement
Root cut without sink fence1Not-Quiescentalready scheduled old-atom effect remains admissible
Root cut and sink fence2Quiescentidentical already scheduled effect rejected at the sink
Restart and stale-process interleaving2Quiescentpersisted barrier is reloaded under the transaction lock
Alternate-root rebind1Quiescentexact current root- BB epoch-2 atom replaces, rather than edits, root- AA authorization
Opaque endpoint / missing fence2Indeterminateabsent evidence never becomes a positive certificate
Table 5. Provider-free 17-case late-effect test-suite registration.
Registered checkFresh resultStatus
Expected case verdict and effect outcome17/17pass
Separate checker agreement17/17pass
Cancellation-only / cut-only late effects accepted2/2 and 1/1pass
Cut-plus-fence, restart, and stale-process late effects rejected2/2, 1/1, and 1/1pass
Root decision totalsQuiescent : 6; Not-Quiescent : 3; Indeterminate : 2pass
Alternate-root epoch-2 rebind / dual pre-fence accounting1/1 and 2/2 admissions receiptedpass
Table 6. Fresh-run evidence for the executable 17-case layer.
PremiseRequired deployment factResult when the fact is unavailable
Durable cut linearizationthe root epoch transition and issuance freeze have one durable linearization point and survive restartno positive certificate for that cut
Support-sound projectionevery admitted live authority instance exposes its minimal sufficient root-support witnesses and selected witnessuncovered or ambiguous support is Indeterminate
No root launderinga continuing instance changes support only through an atomic receipt selecting a current witness that excludes the retired atomthe instance remains dependent on the retired atom
Complete carrier coveragecredentials, tasks, descendants, triggers, reservations, prepared operations, and other registered persistence mechanisms are enumerated or soundly upper-boundeduncovered carriers remain open or unknown
Sink mediation and fencingevery protected commit crosses a registered sink that rejects the retired epoch after installing the named cut fencean unfenced or bypassable sink cannot sign a positive leaf
Leaf authenticity and compatibilityleaf signatures, identities, manifests, cut identifiers, configurations, and watermarks are authenticated and mutually compatibleconflicting or replayed leaves are rejected
Table 7. Premises for the root-scoped no-false-quiescence result.
More in this topic

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 273 papers

Explore similar work

CardsList
Sep 13, 2026

Runtime Authorization for Resources Acquired by AI Agents

By acquiring compute, credentials, accounts, services, and other agents, autonomous AI agents can introduce new authority into a task. Payment, budget, OAuth, mandate, and fulfillment checks can validate transaction conditions without deciding whether a returned resource may become usable authority. This post-fulfillment activation gap spans tool-mediated creation, inter-agent delegation, and agentic commerce. We present a provenance-bounded runtime authorization architecture. It quarantines acquired outputs, resolves their actual capabilities from authenticated provider evidence through a versioned resolver, and activates them only through a current activation transaction that checks the resolved manifest, provenance, epochs, and a downward-closed relational envelope over a typed resource-capability hypergraph. The envelope preserves correlated identity, effect, data, delegation, and graph-wide limits. Single-use effect permits are revalidated and consumed at effect linearization. Under explicit assumptions, we prove eight safety properties covering quarantine, backing, non-amplification, split non-evasion, crash/retry, refunds, epochs, and effect confinement. Across five resource classes, reference semantics accepted 20/20 benign traces and rejected 40/40 registered unsafe traces over 810 events; an independent checker agreed on 60 base and 40 refinement traces and rejected 89/89 tamper tests. Frozen Codex and Gemini Model Context Protocol (MCP) client components completed 54/54 deterministic local stdio calls. In a registered 18-case staged MCP-to-Docker composition, both benign paths completed, and none of the 16 unsafe paths added an unauthorized Docker start request. A five-source audit classified 1,248 field pairs across 32 units; no unit alone supplied a complete activation profile.

Genliang Zhu, Chu Wang

Accentrust · Georgia Institute of Technology · Accentrust, Vancouver, Canada +3

AI Agent SecurityRuntime Enforcement for AI AgentsTool-Use AuthorizationCapability-Based Security
AskPDF
Aug 30, 2026

VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows

Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation APIs still resemble token or subtree invalidation. When one delegation is withdrawn, the runtime must know which agents lose authority while independently authorized agents keep working. We study this authority consistency problem and introduce VERA (Verifiable Edge Revocation for Agents), a verifier-checkable revocation contract and API emitted by agent-runtime adapters as signed evidence. Under disjunctive authority, revoking edge e invalidates exactly T_intent(e,G) = reach(G) \ reach(G \ {e}), the agents whose every authorizing root path used e. Used as a contract, this target exposes two runtime failures: tree cascades over-revoke shared agents, while deployer-scoped cascades under-revoke cross-domain descendants. In a LangGraph framework-replt cells repeated 20 times yield 500compiled-framework traces and 2,000 valid signed delegation decisions; 13/25 cells contain runtime multi-parsharing and 8/25 contain cross-deployer shies 500/500 target proofs, preserves all320 alternate-parent shared-agent cases that tree cascade revokes, and rejects unauthorized signers and omission attacks. Baseline replay over 1,9that holder/node and tree-style targetscannot express this behavior. We further validate schema portability on A2A, AutoGen, and CrewAI artifacts: nine traces, including five executable Cregned delegation events that pass schema and signature checks.

Lifei Liu, Haoran Yu, Xiaochong Jiang

Independent Researcher

Runtime Enforcement for AI AgentsAccess ControlTool Access Control for LLM AgentsMulti-Agent System Security
AskPDF
Sep 29, 2026

Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback

Self-modifying AI agents can replace, fork, and roll back identity-bearing software while descendants remain executable. Per-successor authorization does not constrain the resulting population: siblings may duplicate quotas, combine permissions, survive ancestor cuts, or overlap predecessors during promotion. We define authorization succession, which conserves authority across the active frontier of a single-parent generation forest. Our external protocol binds each generation to a manifest, root, unique parent, complete lineage, and fresh population sequence. Separate invariants bound root-lifetime consumption and current population exposure. A staged reservation freezes predecessor residual authority during replacement, while a partitioning fork validates the complete child family. Each commit atomically fences the predecessor and activates successors. Ancestor cuts invalidate dependent descendants; rollback creates a fresh generation without restoring spent authority; and a new root requires an independent grant. Under complete mediation, authenticated records, sound effect abstraction, durable monotone state, and complete lineage accounting, we prove population-safe succession, fork conservation, revocation closure, atomic handoff, rollback non-reminting, and exclusion of self-certification. An executable evaluation covers 32 registered decisions through direct-call and mailbox mappings (64/64 replays; 28 allows, 36 denies). An independent checker accepts all 64 original traces and rejects 28/28 semantic mutants; 12/12 profile invariants, 16/16 crash cuts, and 32/32 contender schedules pass. Two external adapters reproduce all 32 decisions around measured OurArk and Darwin Godel Machine mutations, including fresh-process restart, atomic succession, and predecessor rejection. The results establish authorization succession for registered protected effects.

Genliang Zhu, Chu Wang

Accentrust, Vancouver, Canada · Georgia Institute of Technology, Atlanta, Georgia, USA · University of Illinois Urbana-Champaign, Urbana, Illinois, USA

AI Agent SecurityRuntime Enforcement for AI AgentsSelf-Evolving Agents
AskPDF