cs.AIOct 11, 2026

Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways

Authors: Lifei Liu, Haoran Yu, Danping Zhang

Organizations: Independent Researcher Seattle, WA, USA · Nanchang Hangkong University Nanchang, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Distributed agent workflows cache delegated authority at tool gateways. Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped. We define C0-C5, a bounded outcome contract spanning issuer commit through effect prevention, and implement it as a persistent monitor over a frozen gateway set, call set, and observation window. A 14-case fault matrix checks conservative classification, sticky violations, restart persistence, and evidence immutability. In a derived audit of its eight semantic cases, treating C3 or C4 as completion produces seven or five false positives, respectively; the bounded C0-C5 verdict produces none. Descriptive scaling covers 1,024 gateways and 10,000 effect vectors. The primary experiment uses the maintained Keycloak 26.7 identity server and measures the contract across two durable receivers, eight physical agent-tool gateways, Filesystem and PostgreSQL effects, and 16 AWS hosts in three availability zones. Normal delivery and recovery commit no effects. Under receiver-selective non-delivery, transport acknowledgment and receiver persistence still succeed, but 112 of 225 calls (49.78%) are admitted, and all 112 effects commit in every treatment block. A separately provisioned execution repeats the result. OPA/Toxiproxy and a live three-role LLM workflow with networked MCP tools reproduce the persisted-but-not-enforced boundary on narrower surfaces. Finally, an unmodified external MCPMark agent executes 60 closed-loop task arms. Normal C4 denies all 31 exposed post-barrier calls and commits no effect; selective C3 allows 344 calls and commits 145 effects across Filesystem and PostgreSQL. Transport success is therefore evidence of progress, not a revocation-completion verdict.

Figures & tables

Figure 1. Revocation completion requires outcome evidence beyond delivery. Both paths reach C2/C3; only the healthy path reaches C4 and denies agent calls, whereas receiver-selective non-delivery (orange cross) leaves stale gateways able to reach Filesystem or PostgreSQL. The monitor joins C0–C5 evidence over a frozen bound; dotted lines carry evidence, not control. E-B24 uses frozen vectors, while E-B28 uses adaptive MCPMark calls. A two-layer architecture separates the signed revocation control plane from real agent-tool execution. Keycloak sends an event to two durable receivers. Receiver A reaches gateways one through four and installs deny state. An orange cross interrupts receiver B's handoff to gateways five through eight, which retain stale authority. Agent calls are denied on the healthy path but can reach Filesystem and PostgreSQL effect services on the stale path. A monitor combines C0 through C5 evidence and returns complete, violated, or no-exposure verdicts.
StudyEvidence surfacePrimary observationRole in this paper
E-B24Primary and separately provisioned repeatability executions; 16 AWS hosts, 8 gateways, 3 zones, durable receivers, real effectsC2/C3 coexist with missing C4 and 112 committed effects per block; the second execution exactly matches the first.Primary causal result and repeatability.
E-B25OPA 1.17 policy engines and Toxiproxy 2.12 on one Docker hostA post-persistence fault leaves one engine stale: 112/225 effects commit and the monitor returns VIOLATED .Cross-implementation replication.
E-B28Unmodified external MCPMarkAgent; 10 frozen tasks, 2 repetitions, Filesystem and PostgreSQL ( Wu et al., 2025 )Normal C4 denies all 31 exposed later calls with zero effects; selective C3 allows 344 and commits 145 effects.Closed-loop agent-workload replication.
E-B25/26OPA/Toxiproxy and a narrow live multi-role MCP workflowThe post-persistence boundary recurs under another policy engine and under two model-generated networked actions.Cross-stack execution sanity.
E-B27Frozen monitor fault matrix and local SQLite scalingAll 14 conservative-classification and integrity rows pass; 33 fresh trials span 1,024 gateways and 10,000 effect vectors.Monitor correctness and engineering-cost boundary.
QualificationE-B17/18/20/22/23: mechanism models, local MCP execution, MCPMark traces, and external Keycloak PUSH/POLL ( Wu et al., 2025 )The 50% cost gate and 30% workload hypothesis fail; real delivery paths can reach enforcement when the downstream handoff completes.Cost/workload boundaries and execution sanity checks.
Table 1. Evidence ladder. “External” means independently maintained input or implementation, not that every adapter or gateway component is external.
PhaseRun 1 allowed/effectsRun 2 allowed/effectsFSPGB: C2B: C3/C4
Normal0/00/000HTTP 202persisted/4 receipts
Receiver–gateway fault3,360/3,3603,360/3,3601,6801,680HTTP 202persisted/0 receipts
Recovery0/00/000retainedretained/4 receipts
Table 2. Aggregates from the two separately provisioned E-B24 executions. Each execution contains 30 paired blocks and 6,750 calls per phase. Effects are counted by independent Filesystem and PostgreSQL oracles; C2–C4 describe receiver B. The FS and PG columns give the per-execution decomposition; the executions have identical totals.
StudyArmAllowedEffectsMonitor
E-B25 OPAnormal0/2250v1 complete ∗
 fault112/225112violated
 recovery0/2250v1 complete ∗
E-B26 live MCPnormal0/20v1 complete ∗
 fault1/21violated
 recovery0/20v1 complete ∗
Table 3. Cross-stack and closed-loop replications. E-B28 denominators include only observed post-barrier calls; no-exposure runs are reported separately.
DetectorTPFPTNFN
C3 persistence as complete1700
C4 receipts as complete1520
Bounded C0–C5 monitor1070
Table 4. Derived completion-detector audit on E-B27’s eight frozen semantic cases. Positive means COMPLETE_FOR_BOUND .
GatewaysVectorsReceipt totalEffect totalAssess p95
  (ms)(ms)(ms)
82253.5368.091.31
1,0242253,811.2777.287.49
810,0003.6610,216.5025.10
Table 5. E-B27 local monitor scaling. Values are medians across three fresh stores; assess is p95 over 100 post-warm-up calls.
Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 2. E-B17 mechanism-level boundary. At 20% selective operator suppression, push plus independent repair reduces stale calls and remains under the frozen message cap. At 50%, it crosses the 8.1-message cap. Two panels compare stale calls and control messages for push plus independent repair and matched log polling at 20 and 50 percent selective suppression.
SuppressionMechanismStale calls/gwCompleteAuditMsgs/gwFeasible
20%Push + repair0.8771.01.08.001yes
20%Matched log polling50.5491.01.06.001yes
50%Push + repair1.6631.01.09.501no
50%Matched log polling50.5491.01.06.001yes
Appendix
Table 6. Confirmatory E-B17 cells. Availability loss is zero and bytes stay below 8,192 for all rows. Feasibility is conjunctive.
E-B17 rowBehavior retained in the model20% matched disposition
AIP -03Signed events; 1/2/4-second retries; status fallback ( Singla, 2026 ) .Fails: completeness 0.8; audit evidence 0.
DRP -10/60Signed log polling with independently checkable evidence ( Nelson, 2026 ) .Passes after the disclosed 10-second rescaling.
DRP -10/300Relaxed polling posture from the same draft ( Nelson, 2026 ) .Passes, but matches DRP -10/60 and is not an independent replication.
HBHCPublished 10/30-second heartbeat with multipath gossip ( Deochake, 2026 ) .Fails: no positive event or audit evidence; 12 messages/gateway exceeds the cap.
CAEP/SSFSigned session-revoked event over a modeled local stream ( Cappalli and Tulshibagwale, 2025 ; Tulshibagwale et al., 2025 ) .Fails: completeness 0.8; audit evidence 0.
Status listSigned snapshot polling at the matched 10-second interval.Fails: completeness 0.8, audit evidence 0, and 750,000 bytes/gateway.
Appendix
Table 7. Source-to-model disclosure for E-B17. Rows retain selected behavior under common traces. They are neither conformance tests nor production reimplementations.
StudyEvidence addedExplicit limit
E-B1–B3Suppression boundary, delivery regimes, and mapping from delay to stale-authority damage.Discrete-event models and synthetic rates.
E-B4Below-quorum rejection and signed-checkpoint split-view detection.Detection requires eventual cross-observation.
E-B5–B7A2A-shaped events, loopback signed transport, and parameter sensitivity.Local serialization/transport, not third-party conformance.
E-B8–B9Cached gateway effects and A2A lifecycle-binding cells.Gateway and compatibility models.
E-B10–B12Gateway/tool/log TCP paths, envelopes, dropped push, delayed log, partition heal, and restart.Scripted single-host faults.
E-B13–B15LangGraph/CrewAI trace bridge, separate processes, official MCP typing, and a compiled LangGraph workflow.Local execution, not production interoperability.
Appendix
Table 8. Secondary checks validate components and boundaries. None replaces the confirmatory E-B24 result.
More in this topic

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 270 papers

Explore similar work

CardsList
Aug 30, 2026

VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows

Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation APIs still resemble token or subtree invalidation. When one delegation is withdrawn, the runtime must know which agents lose authority while independently authorized agents keep working. We study this authority consistency problem and introduce VERA (Verifiable Edge Revocation for Agents), a verifier-checkable revocation contract and API emitted by agent-runtime adapters as signed evidence. Under disjunctive authority, revoking edge e invalidates exactly T_intent(e,G) = reach(G) \ reach(G \ {e}), the agents whose every authorizing root path used e. Used as a contract, this target exposes two runtime failures: tree cascades over-revoke shared agents, while deployer-scoped cascades under-revoke cross-domain descendants. In a LangGraph framework-replt cells repeated 20 times yield 500compiled-framework traces and 2,000 valid signed delegation decisions; 13/25 cells contain runtime multi-parsharing and 8/25 contain cross-deployer shies 500/500 target proofs, preserves all320 alternate-parent shared-agent cases that tree cascade revokes, and rejects unauthorized signers and omission attacks. Baseline replay over 1,9that holder/node and tree-style targetscannot express this behavior. We further validate schema portability on A2A, AutoGen, and CrewAI artifacts: nine traces, including five executable Cregned delegation events that pass schema and signature checks.

Lifei Liu, Haoran Yu, Xiaochong Jiang

Independent Researcher

Runtime Enforcement for AI AgentsAccess ControlTool Access Control for LLM AgentsMulti-Agent System Security
AskPDF
Aug 21, 2026

AID-Guard: Stateful Authorization for Delegated Agent Effects

Tool-using AI agents turn delegated tasks into provider effects, yet authorization often ends at admission while provider state, delivery, retry, and recovery evolve. A request may change before commit, or response loss may cause a replacement to create a second effect from one approval. We present AID-Guard, a stateful authorization-to-effect closure protocol. It revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result or certified no effect with a delivery fence. For supported provider contracts, one reservation yields at most one effect across retry and recovery. To our knowledge, it is the first evaluated agent-authorization protocol to unify these controls in one lifecycle. We implement a Python/SQLite prototype. In a declared loopback MCP domain, 13 live mutations caused no unauthorized provider effects, three concurrent histories were linearizable, and evidence bundles supported public verification and replay. All 210 Stripe provider-contract trials matched predeclared outcomes. Across Stripe and Resend, 40 terminalize-successor schedules, 30 overlapping races, and 10 crash-recovery schedules completed without duplicate effects. Under complete proposer compromise, AID-Guard blocked 44/44 attacks and admitted 44/44 matched legitimate proposals. Its strict exact-manifest profile reduced benign utility by 35.4 to 43.8 percentage points; a typed frontier recovered 9-10 completions without observed unsafe effects. A composition study blocked 20/20 post-admission lifecycle attacks and preserved 8/8 valid or exact-retry executions. The results support authorization-to-effect binding under the evaluated effect-path inventory, provider contracts, and failure schedules.

Yingzhe Tong, Leyu Dai, Songhui Guo

Information Engineering University

AI Agent SecurityTool-Use AuthorizationRuntime Enforcement for AI Agents
AskPDF
Aug 19, 2026

Outcome Monitors: Recovery Affordances for Silent Tool Failures

When a tool call times out, the agent sees the failure and can route around it. A cached error page or negative price can instead arrive in the expected format and be consumed as fact. We introduce Outcome Monitors, which detect violations of outcome contracts mined from task-disjoint traces or derived from public schemas. On a violation, the monitor preserves the result and issues a nonbinding receipt naming the violated property and public recovery tools. In frozen, prespecified evaluations with injected failures, Outcome Monitors raise ToolMaze completion from 10.9% to 28.1% across four models in two provider families and replicate in a third. In tau-bench retail, completion improves by 14.0 and 12.0 points on two tiers. In separate ToolMaze controls, removing the recovery-tool list eliminates the measured gain and restoring it recovers the effect; diagnostic detail and timing produce no detectable differences. Gains concentrate where the fault blocks completion. On a suite transcribed from a published incident taxonomy, detection outside the mined vocabulary falls to 46%, though delivery continues and completion is unchanged. Recovery tools are the active receipt content in these controls; extending detection beyond the contract vocabulary remains open.

Sugam Panthi, Rabab Abdelfattah

The University of Southern Mississippi

AI Agent MonitoringLLM Agent ReliabilityFault Detection
AskPDF