cs.CRSep 29, 2026

Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback

Authors: Genliang Zhu, Chu Wang

Organizations: Accentrust, Vancouver, Canada · Georgia Institute of Technology, Atlanta, Georgia, USA · University of Illinois Urbana-Champaign, Urbana, Illinois, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Self-modifying AI agents can replace, fork, and roll back identity-bearing software while descendants remain executable. Per-successor authorization does not constrain the resulting population: siblings may duplicate quotas, combine permissions, survive ancestor cuts, or overlap predecessors during promotion. We define authorization succession, which conserves authority across the active frontier of a single-parent generation forest. Our external protocol binds each generation to a manifest, root, unique parent, complete lineage, and fresh population sequence. Separate invariants bound root-lifetime consumption and current population exposure. A staged reservation freezes predecessor residual authority during replacement, while a partitioning fork validates the complete child family. Each commit atomically fences the predecessor and activates successors. Ancestor cuts invalidate dependent descendants; rollback creates a fresh generation without restoring spent authority; and a new root requires an independent grant. Under complete mediation, authenticated records, sound effect abstraction, durable monotone state, and complete lineage accounting, we prove population-safe succession, fork conservation, revocation closure, atomic handoff, rollback non-reminting, and exclusion of self-certification. An executable evaluation covers 32 registered decisions through direct-call and mailbox mappings (64/64 replays; 28 allows, 36 denies). An independent checker accepts all 64 original traces and rejects 28/28 semantic mutants; 12/12 profile invariants, 16/16 crash cuts, and 32/32 contender schedules pass. Two external adapters reproduce all 32 decisions around measured OurArk and Darwin Godel Machine mutations, including fresh-process restart, atomic succession, and predecessor rejection. The results establish authorization succession for registered protected effects.

Figures & tables

ExecutionLocally acceptable observationPopulation violationRequired state
Sibling duplicationBoth children remain below the parent’s individual ceilingThe pair receives two copies of one budget or executor shareAggregate allocation and residual
Relational spliceEach branch exposes only an allowed field projectionBranch coordination synthesizes a complete effect tuple never certified by one authority witnessComplete effect relation and holder ownership
Ancestor-revoke leakOffline descendant presents a previously valid child authorization recordIts witness still depends on the revoked ancestor atomLineage cut and complete frontier
Dual-active promotionNew generation activates; predecessor fence is retried after a crashOld and new generations both reach the protected sinkAtomic replacement commit
Rollback replayHistorical body digest and old authorization record matchRetired sequence, spent budget, or revoked grant is reusedFresh generation sequence and monotone identity/state guards
Self-certificationDistinct certifier identifiers approve a candidateAll certifiers are declared under the candidate’s control rootEvidence-root independence
Table 1. Strict executions separating population-aware succession from per-generation acceptance.
IDAssumptionEnforced obligation
A1Complete effect mediationEvery security-relevant commitment named by the profile crosses a broker that validates the current generation, complete lineage-atom closure, allocation, and complete effect tuple at its own linearization point.
A2Authentic canonical identityGeneration identities, the unique authorization parent, body/configuration commitments, authorization and certification records, cuts, allocations, receipts, and evidence-root identities use unambiguous canonical encodings and authenticators whose acceptance cannot be produced from the candidate’s control root alone.
A3Durable monotone generationsGeneration and root epochs never decrease or reactivate; accepted evidence/authorization records, lineage cuts, fences, root-lifetime debit records, and effect-request replay records cannot be rewritten.
A4Complete lineage accountingEvery non-root generation has exactly one registered authorization parent before activation. A fork may create several successors atomically, but each successor names the same single predecessor; the predecessor is fenced. The ledger retains every resulting parent edge and lineage atom across offline, delayed, and nested descendants until a terminal cut or independent re-root removes authority.
A5Sound population algebraEffect normalization preserves every policy-relevant correlation; the registered effect-membership predicate and authority join are monotone, multiplicity-aware where policy requires it, additive for consumable resources, and conservative for unknown fields.
A6Atomic population transactionsReservation, allocation replacement, activation, predecessor fencing, and budget consumption execute as serializable durable transitions with exact population-version and source-residual preconditions. A held reservation either blocks predecessor consumption or is made stale by it.
Table 2. Assurance assumptions for a registered succession profile.
Figure 1. Authorization-succession architecture. Candidate production and evidence feed an external ledger; only a committed population transition changes the active generation frontier. The effect broker revalidates current lineage and allocation state at the protected commitment point. A top row contains mutable candidate runtime, canonical generation identity, independent evidence roots, and exact succession authorization. They feed an external generation registry and population ledger. The ledger determines the active generation frontier, which is checked by a protected-effect broker before a typed effect commits.
LayerBound factSecurity role
Reference manifestcode digest, control path, enforcement-configuration digest, memory-policy digest, model-route digest, policy-compiler digest, proposer identifier, Skill-closure digestfixes the exact eight-field executable schema
Reference lineagepopulation and root identifiers, root epoch and grant digest, one parent-generation identifier, complete lineage-atom setmakes single-parent succession and fork ancestry explicit
Reference lifetimefresh population-issued generation sequenceseparates launches and blocks historical identity replay
Reference evidenceproposer and certifier principals mapped through frozen control roots; subject-manifest and evidence digestschecks digest binding and declared-root separation
Registered extensionany additional prompt, tool, harness, dependency, normalizer, or profile field named by a larger governed schemaextends the abstract identity obligation only when a deployment resolves and binds it
Table 3. Generation identity inputs and their realization status.
Contract fieldDirect-call sourceMessage-mailbox source
Authorization parenttyped predecessor identifiertopic-handler predecessor identifier
Body commitmentcanonical manifest fieldscanonical manifest fields
Generation freshnessledger-owned sequence assigned during the commandledger-owned sequence assigned while handling the message
Evidencedirect certification commandcertification topic and handler
Requested authoritydirect reservation commandreservation topic and handler
Lifecycle signalexplicit succession operationversioned succession message
Table 4. Logical runtime-to-succession mapping contract.
GroupCasesExpectedDistinguishing obligation
Mutation surfacescode, model route, Skill/dependency closure, memory policy, policy compiler, enforcement configuration ×\times safe refactor6 Allowexact effect relation and control path preserved
Mutation surfacessame six surfaces ×\times safe narrowing6 Allowstrict sub-allocation with no returned spent resource
Mutation surfacessame six surfaces ×\times effect expansion6 Denyrequested tuple/share exceeds parent or population residual
Mutation surfacessame six surfaces ×\times control-path weakening6 Denyidentity, evidence, ledger, or broker mediation removed
Legal successionsingle replacement; independent re-root2 Allowatomic old/new handoff; old-lineage dependence explicitly severed
Population attackssibling split; nested-successor laundering2 Denyaggregate allocation cannot be copied or hidden by depth
Table 5. Registered 32-case logical corpus.
Evidence familyFrozen denominatorResult and interpretation
Logical corpus32 cases; 14 Allow , 18 Deny32/32 matched the registered verdict under the reference mechanism
Command-surface mappings32 direct-call + 32 mailbox replays64/64 matched; 28 allows, 36 denies; zero cross-mapping disagreement
Independent checking64 complete traces64/64 accepted after independent reconstruction
Semantic regressions28 outer-resealed mutants28/28 rejected for the registered semantic or denominator violation
Reference-profile invariants12 targeted probes12/12 passed: fork allocation, cut, rollback, lifetime debit, idempotency, reservation, and re-root
Durable handoff cuts16 process terminations12 recovered the complete pre-commit state and 4 the complete post-commit state
Table 6. Frozen core evidence. A pass count is over the complete registered denominator shown in the second column.
Mechanism or stated abstractionMatch
Session continuity14/32
Exact-hash all-deny18/32
Per-generation fixed ceiling29/32
Delegation-edge cascade23/32
Complete authorization-succession profile32/32
Table 7. Logical classifications matching the registered oracle.
DimensionExecuted realizationBoundary
Authorization lineageEvery non-root successor has one authorization parent. Fork atomically partitions one predecessor’s residual and fences that predecessor.No merge transition or multi-parent generation identity is implemented.
Manifest commitmentExactly eight fields are bound: codeDigest , controlPath , enforcementConfigDigest , memoryPolicyDigest , modelRouteDigest , policyCompilerDigest , proposerId , and skillClosureDigest .A deployment profile must add every further security-relevant surface; an omitted surface is outside this result.
Authority algebraAdditive nonnegative integer budgets and opaque, single-holder effect atoms. The executed budgets are actions and tokens .No general lattice evaluator, multi-holder effect relation, or arbitrary effect normalizer is implemented.
Record bindingLedger-issued, digest-bound grants, certification records, reservations, events, and receipts are checked against a frozen declared-control-root registry.The prototype tests record binding and declared-root separation, not caller authentication or key possession; the abstract authenticated-record predicates remain deployment premises.
DurabilityIntent, temporary state, file-image replacement, and directory synchronization around one handoff.Atomicity evidence is limited to this file-image replacement protocol; it does not cover distributed consensus or effect-delivery atomicity.
Table 8. Reference realization boundary.
Evidence bundleDomain-separated aggregate report digest
Provider-free coresha256:d92b3eefe1a7de48e936505c828ceff3bf83ed831a33e3bedef16cd4c3cb98ef
OurArk Genesis/Enochsha256:02e26bac1a4e05855f9be4ed750a9e38de84236f6d18c19f9d0888730e4e64f8
Darwin Gödel Machinesha256:21b26c421d36d827b38bc89cfa0df301b477ee45da4f084468de25f002c73851
Table 9. Independent aggregate seals for the frozen evidence bundles.
Line of workPrincipal objectEstablished controlState used by this work
Earned Authorityone evolving grant holdertransition envelope and fixed effect ceilingactive generation family and allocation transaction
PRVrecursive activation trajectoryprobabilistic risk escrow and anytime harm bounddeterministic typed effects, resources, epochs, and lifetime
HBHC / VERAhierarchical credentials / delegation edgescascading or verifiable revocationgeneration cut joined with handoff, re-root, and rollback
OurArk / DGMversioned descent / mutation archiveidentity-bearing evolution and candidate selectionprotected-effect authority assigned to current generations
SEVerA / RegenHarness / Bad Geniussynthesized program / versioned harness candidateconstrained outputs, evidence-gated rollout, and counterfactual validationexternal succession of executable generations
Root-scoped quiescenceretired authorization-root carrierspre-cut accounting and post-fence exclusionallocation and replacement of generation principals
Table 10. Boundary to the closest lines of work.
Evidence classObjectSupported statement
Formaldefinitions, assumptions, lemmas, theorems, proofsconditional protocol safety for all executions satisfying the model premises
Reference executionregistered finite corpus, ledger, brokers, two logical adaptersimplementation conformance over the executed mutation and lineage cases
Adversarial verificationindependent checker and consistently resealed semantic regressionschecker separation and detection of the registered trace-level violations
Fault executiondurable crash cuts and deterministic schedulesrecovery and atomicity over the exact enumerated interruption/interleaving space
External refinementfrozen public runtime commits, native descent or edit, fresh restart, and broker tracesfield mapping and boundary behavior for the specifically executed versions
Table 11. Evidence classes and their admissible interpretation.
More in this topic

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Explore similar work

CardsList
Oct 4, 2026

Runtime Authorization of Self-Generated Subgoals in Long-Horizon Tool-Using AI Agents

Long-horizon tool-using AI agents create subgoals, replan, delegate work, and compose sibling results. Per-tool permission checks cannot establish that a changing goal graph remains within the principal-approved task. We address this authorization gap in a finite structured domain with one principal and one authorization root. Each proposed goal-graph mutation carries a version-bound witness that its continuation traces, resources, obligations, invariants, and closing condition refine the active root contract; every protected effect is rechecked at an atomic commit boundary. Free-form goal text supplies no authority. We prove trace-policy and modeled forbidden-state preservation under explicit mediation, abstraction, freshness, and atomicity assumptions, plus conditional root-success preservation, a separation result for memoryless allowlists, exact finite-domain decidability, and universal-safety monotonicity under sound abstraction refinement. An executable model explores 340 states and 419 transitions. Across 96 matched cases covering 25 structural schemas, the complete mechanism commits zero forbidden states in 48 drifted cases and completes all 48 benign counterparts. Two public upstream runtime paths execute 258 native dispatches across 32 cases, with every case-level decision and receipt chain matching. A frozen host-local study covers 129 synthetic one-factor-at-a-time cells, all matching fixed decisions and reasons. A history-aware continuation comparator blocks every modeled bad trace prefix but commits all operations in 11 cases whose violations lie in typed resources, freshness, or explicit-join evidence outside its trace projection. Within the registered structured domains, runtime authorization preserves useful replanning while preventing self-generated subgoals from becoming a source of new authority.

Genliang Zhu, Chu Wang

Accentrust, Vancouver, Canada · Georgia Institute of Technology, School of Computer Science, Atlanta, Georgia, USA · University of Illinois Urbana-Champaign, Department of Computer Science, Urbana, Illinois, USA

Runtime Enforcement for AI AgentsTool-Use AuthorizationLong-Horizon LLM AgentsLLM Agent Verification
AskPDF
Sep 18, 2026

Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution

Long-running AI agents outlive initiating processes through credentials, delegated tasks, queues, callbacks, reservations, and provider-side operations. Cancellation, process exit, and credential revocation neither close every pre-cut carrier nor distinguish independently authorized shared work. We define root-scoped authorization quiescence: for each manifested sink, a certificate accounts for every cut-relevant acceptance under the retired root-epoch atom that precedes its local fence and excludes protected acceptance under that atom after the fence, while permitting exact rebind to a current, independently sufficient support. The root-scoped quiescence protocol linearizes a root cut, fences old-root expansion and protected sinks, represents alternative and conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates into a cutset over registered old-root paths. Exact channel-token accounting reconciles transfers; missing or conflicting evidence remains indeterminate. Under stated assumptions, we prove post-cut issuer non-expansion, support-sound projection, compositional soundness under exact channel conservation, independent-support preservation, merge-order independence, and crash/replay stability. A provider-free late-effect test suite matches 17/17 registered outcomes. Two cancellation-only and one cut-only execution accept the same class of already scheduled late effect; two cut-plus-fence executions, one restart, and one stale-process execution reject it. A separately implemented checker verifies 17/17 traces and rejects 44/44 consistently rehashed semantic regressions. The certificate establishes root-relative authorization quiescence within its bound manifest and configuration, not global idleness, rollback, or business completion.

Genliang Zhu, Chu Wang

Accentrust, Vancouver, Canada · Georgia Institute of Technology, Atlanta, Georgia, USA · University of Illinois Urbana-Champaign, Urbana, Illinois, USA

Runtime Enforcement for AI AgentsTool Access Control for LLM AgentsLLM Agent VerificationLong-Horizon LLM Agents
AskPDF
Jul 26, 2026

Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents

Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. This improves adaptation but creates a distinct authorization problem. Tool-enabled agents can turn model errors and prompt injections into consequential external actions; when evolution occurs under a live grant, the subject exercising that authority or the context in which it acts may no longer match what the user evaluated. Evolution can change both the effects reachable under an old grant and the authority required by the task, which may rise, fall, or become incomparable. Existing tool policies constrain actions but do not determine when a grant survives this change. We formulate authorization continuity: when does an existing grant remain valid, how may active authority change, and what boundary must never move? Our state-bound model fixes a transition envelope and an immutable effect ceiling at grant time. The envelope determines whether the grant survives a mutation; below the ceiling, authority may contract freely and expand only under specified evidence conditions. We distinguish requested from realized effects and prove that, under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling. Agent-produced evidence may allocate authority below the ceiling but cannot raise it. Finally, we map six mutation classes to their authorization consequences.

Zhaoxi Zhang, Xiaomei Zhang

University of Technology Sydney · Griffith University

Tool-Use AuthorizationTool Access Control for LLM AgentsSelf-Evolving Agents
AskPDF