cs.PLSep 18, 2026
SaveAuthorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution
Organizations: Accentrust, Vancouver, Canada · Georgia Institute of Technology, Atlanta, Georgia, USA · University of Illinois Urbana-Champaign, Urbana, Illinois, USA
Abstract
Long-running AI agents outlive initiating processes through credentials, delegated tasks, queues, callbacks, reservations, and provider-side operations. Cancellation, process exit, and credential revocation neither close every pre-cut carrier nor distinguish independently authorized shared work. We define root-scoped authorization quiescence: for each manifested sink, a certificate accounts for every cut-relevant acceptance under the retired root-epoch atom that precedes its local fence and excludes protected acceptance under that atom after the fence, while permitting exact rebind to a current, independently sufficient support. The root-scoped quiescence protocol linearizes a root cut, fences old-root expansion and protected sinks, represents alternative and conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates into a cutset over registered old-root paths. Exact channel-token accounting reconciles transfers; missing or conflicting evidence remains indeterminate. Under stated assumptions, we prove post-cut issuer non-expansion, support-sound projection, compositional soundness under exact channel conservation, independent-support preservation, merge-order independence, and crash/replay stability. A provider-free late-effect test suite matches 17/17 registered outcomes. Two cancellation-only and one cut-only execution accept the same class of already scheduled late effect; two cut-plus-fence executions, one restart, and one stale-process execution reject it. A separately implemented checker verifies 17/17 traces and rejects 44/44 consistently rehashed semantic regressions. The certificate establishes root-relative authorization quiescence within its bound manifest and configuration, not global idleness, rollback, or business completion.
Figures & tables
| Observation or mechanism | What it establishes | What remains for root-scoped quiescence |
|---|---|---|
| Cancellation acknowledgement | a task endpoint accepted or attempted a cancellation-state transition | whether underlying work, descendants, prepared effects, and transferred messages can still commit |
| Process exit | one observed process terminated | whether authority escaped into remote tasks, credentials, triggers, queues, or provider state |
| Token revocation | a named token is no longer accepted under the issuer’s revocation semantics | derived credentials, cached authorization, already accepted work, and effects not mediated by that token |
| Exact delegation-edge revocation | the authority consequences of removing a selected graph edge | obligations and carrier effects already emitted before or across the revocation cut |
| Provider-local effect closure | one adapter’s registered local frontier is closed at its fence and watermark | compatible cut identity, complete provider coverage, and messages crossing between leaves |
| Closure-evidence verifier | submitted evidence satisfies a declared closure predicate | execution of the root cut, provider actuation, and distributed collection of compatible leaf evidence |
Table 1. Adjacent observations and the root-scoped quiescence decision.
| ID | Assumption | Enforced obligation |
|---|---|---|
| A1 | Issuer mediation and non-expansion | Every transition that issues, delegates, reactivates, or enlarges authority under a root crosses the manifested root issuer and validates the exact root-epoch atom at its root-ledger linearization point. This premise does not treat exercise by an already authorized carrier as a new issuance. |
| A2 | Authentic canonical evidence | Grants, root atoms, support records, cuts, manifests, fences, channel dispositions, rebind receipts, frontier statements, and certificates use unambiguous canonical encodings and unforgeable authenticators. |
| A3 | Durable root linearization | A cut retiring epoch , the advance to , the phase transition, the frozen manifest, and the exact cut-target token frontier commit atomically in a serializable durable ledger; epochs never decrease and a retired atom is never reactivated. The root transaction does not itself install a provider fence. |
| A4 | Support-provenance completeness | Every carrier and handoff records all policy-relevant minimal authorization supports, the witness actually selected for its current authority, and authenticated parent-to-child provenance. Omission or ambiguity yields an unknown carrier. |
| A5 | Per-sink fence and frontier soundness | Every manifested effect sink serializes commitment admission with a durable local barrier . The barrier causally follows authenticated observation of cut , rejects every later local attempt selected under the retired atom, and yields a frontier that completely enumerates every cut-relevant acceptance under that atom that was outstanding when committed or was admitted from a dependent carrier before , while closing each such commitment’s future-use, instance, and lineage frontier. |
| A6 | Registry and manifest completeness | The frozen manifest covers every runtime, provider, effect sink, and channel class reachable from work selected under the retired atom. Stable scans include all carrier creation and transition events through their stated watermarks. |
Table 2. Assurance assumptions for a registered quiescence profile.
Figure 1. Protocol separation. The root cut retires issuer-side creation and expansion of old-epoch authority; adapter-specific barriers and frontier leaves establish local facts; exact cutset aggregation establishes the composed predicate; a separately implemented checker validates the evidence object. A two-level flow diagram. The top level moves from the root authority issuer through a durable epoch cut, support projection, leaf aggregation, and a root-scoped certificate. Runtime and provider adapters plus frontier barriers feed evidence upward, and a separate checker validates the final certificate.
Figure 2. Minimal-support antichains distinguish alternative from conjunctive authority. Dashed availability is not authorization until an atomic rebind selects it. On the left, roots A and B independently support one carrier; the A edge is selected and the B edge is merely available until rebind. On the right, A and B jointly support a carrier, so retirement of A leaves no sufficient witness.
| Field group | Bound fact | Acceptance condition |
|---|---|---|
| Identity | provider, adapter profile, key identity, schema version | admitted and unambiguous |
| Cut header | root, retired epoch, cut id, cut-record digest | exact agreement across leaves |
| Coverage | manifest/configuration/graph-scope digests; covered ingress, frontier and channels | union equals sealed manifest |
| Barrier evidence | fence receipts, provider-local admission/barrier positions, log watermarks | causal observation of the cut and valid local ordering |
| Local state | open carriers, generators, accepted operations, typed terminal dispositions | no known old-root live blocker; every cut-relevant old-atom pre-fence acceptance has its exact receipt |
| Transfer state | typed SEND and terminal ACK records with unique token maps | exact projected accounting; ACCEPT binds a covered destination carrier |
Table 3. Logical leaf-certificate obligations.
| Endpoint | Persistent carrier | Required barrier/evidence | Nonpositive condition |
|---|---|---|---|
| MCP asynchronous task | task state, provider work, descendants | cut-bound cancel receipt, terminal query, descendant/transfer coverage, protected sink fence | cooperative ack without terminal/frontier evidence |
| A2A delegated task | remote task, artifact, delegated child | task correlation, terminal or fence receipt, outbound child tokens | unsupported cancel, missing child catalog, late artifact path |
| Credential issuer | access/refresh token and derived credentials | issuer tombstone/introspection, propagation bound, derived-token closure | unknown derivation, cache bypass, untrusted expiry |
| Durable queue or trigger | message, retry, cron, webhook, generator | ingress generation fence, gap-free watermark, accepted-message terminal receipts | forgotten generator, watermark gap, unfenced consumer |
| Effect reservation/gateway | reservation, prepare, settlement | cutoff-aware reserve/commit gate and terminal/no-effect receipt | ambiguous prepare/commit, bypassable effect sink |
Table 4. Endpoint correspondence contracts for conforming deployments.
| Scenario group | Cases | Registered outcome | Registered distinguishing fact |
|---|---|---|---|
| Cancellation acknowledgement only | 2 | baseline false-stop | late epoch-1 effect accepted after acknowledgement |
| Root cut without sink fence | 1 | Not-Quiescent | already scheduled old-atom effect remains admissible |
| Root cut and sink fence | 2 | Quiescent | identical already scheduled effect rejected at the sink |
| Restart and stale-process interleaving | 2 | Quiescent | persisted barrier is reloaded under the transaction lock |
| Alternate-root rebind | 1 | Quiescent | exact current root- epoch-2 atom replaces, rather than edits, root- authorization |
| Opaque endpoint / missing fence | 2 | Indeterminate | absent evidence never becomes a positive certificate |
Table 5. Provider-free 17-case late-effect test-suite registration.
| Registered check | Fresh result | Status |
|---|---|---|
| Expected case verdict and effect outcome | 17/17 | pass |
| Separate checker agreement | 17/17 | pass |
| Cancellation-only / cut-only late effects accepted | 2/2 and 1/1 | pass |
| Cut-plus-fence, restart, and stale-process late effects rejected | 2/2, 1/1, and 1/1 | pass |
| Root decision totals | Quiescent : 6; Not-Quiescent : 3; Indeterminate : 2 | pass |
| Alternate-root epoch-2 rebind / dual pre-fence accounting | 1/1 and 2/2 admissions receipted | pass |
Table 6. Fresh-run evidence for the executable 17-case layer.
| Premise | Required deployment fact | Result when the fact is unavailable |
|---|---|---|
| Durable cut linearization | the root epoch transition and issuance freeze have one durable linearization point and survive restart | no positive certificate for that cut |
| Support-sound projection | every admitted live authority instance exposes its minimal sufficient root-support witnesses and selected witness | uncovered or ambiguous support is Indeterminate |
| No root laundering | a continuing instance changes support only through an atomic receipt selecting a current witness that excludes the retired atom | the instance remains dependent on the retired atom |
| Complete carrier coverage | credentials, tasks, descendants, triggers, reservations, prepared operations, and other registered persistence mechanisms are enumerated or soundly upper-bounded | uncovered carriers remain open or unknown |
| Sink mediation and fencing | every protected commit crosses a registered sink that rejects the retired epoch after installing the named cut fence | an unfenced or bypassable sink cannot sign a positive leaf |
| Leaf authenticity and compatibility | leaf signatures, identities, manifests, cut identifiers, configurations, and watermarks are authenticated and mutually compatible | conflicting or replayed leaves are rejected |
Table 7. Premises for the root-scoped no-false-quiescence result.
More in this topic
Runtime Enforcement for AI Agents
Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.
See all 273 papers