Matoi: Selective Revalidation of Consequence Evidence for Agent Authorization

Zexun Wang

cs.CROct 15, 2026

Matoi: Selective Revalidation of Consequence Evidence for Agent Authorization

Authors: Zexun Wang

Organizations: Ond Holdings Inc. Toronto, Ontario, Canada

Abstract

Matoi separates reusable consequence evidence from current execution authority and durable occurrence history. Its finite query-aware contract covers branches, ordered collections and negative lookups. A consumer reuses only its own checked evidence whose observations remain valid; signed requests, live grants, quota and uncertain outcomes remain separate obligations. Conditional correctness arguments distinguish locally serialized claims from nontransactional remote effects. Two studies strengthen cost attribution and domain evaluation. A 1,440-cell matched-wire study repeats 144 authored inputs. With compact input bytes identical, reuse reduces complete lifecycle cost by 3.49 percent in JS and 1.79 percent in Python. Combined representation/reuse reductions against full proof are 10.87 and 16.53 percent; five of twelve family intervals for the matched comparison cross one in each language. A prospectively frozen AgentDojo Banking mapping covers 5/16 user plans and 7/9 attack plans. Both governed strategies preserve five exact benign transfers and refuse 35 reused attack-plan/policy crosses. Pre-satisfied utility predicates are reported separately from completed work. These are original scripted synthetic tools, not autonomous agents or a real bank. Earlier studies retain cheaper protected-cache alternatives, policy-compatible phishing, provider duplication and post-claim revocation. Separate JS/Python consumers establish finite-profile interoperability within the same project; durable recovery rechecks evidence and retains uncertain reservations. The results support a bounded, auditable reuse and execution contract, not a new general incremental algorithm, arbitrary-tool closure, atomic third-party commitment or production superiority.

Figures & tables

Prior framing	Obligation retained	Question examined here
Approval laundering	Represent and contain transitive consequences	When may an existing bounded consequence analysis remain applicable after a state change?
Formation-consistent dispatch	Effect compatibility does not grant interpreter authority	Can evidence refresh preserve the original authorized target and delegation?
Capability attenuation	Caveats restrict rather than manufacture authority	How are a fixed grant and changing evidence kept distinct at execution?
Incremental computation	Reuse needs dependency correctness and a cost model	Which reusable computation is evidence, and which live checks cannot be replaced by that computation?
Reference monitors	Every covered effect must cross the protection boundary	Which mutation and authority update share the declared serialization point?

Table 1: Claim-by-claim comparison. Typed effects, attenuation, dependency tracking and final enforcement are established ideas. The investigated contribution is their explicit applicability contract and measured trade-off, not a claim of inventing those mechanisms.

Evidence design	Trust and deployment obligation
Trusted full evaluation	Trust a complete local evaluator for each snapshot; no untrusted producer certificate is required.
Protected caching / incrementality	Keep complete dependency tracking, retained computations and invalidation state inside the trusted boundary.
Compact complete rechecking	Accept untrusted references only into the consumer’s checked root, then rederive every resolved rule.
Untrusted-producer checked reuse	Protect the same custody; check replacement rules and current applicability of retained subtrees before accepting the root.

Table 2: Trust/baseline comparison. All designs still need live authority and occurrence checks. Measured comparators are same-project implementations and internal ablations; no measured external-baseline advantage is established.

Change after preparation	Evidence consequence	Authorization consequence
Dashboard theme changes	Supported dependency projection is unchanged	Bound can be reused; fresh authority and budget checks remain
Refund becomes 5,000 cents	Relevant operand changes; recompute the effect	May remain within an explicitly delegated grant; a new occurrence still consumes its own budget
Notification points outside	Relevant destination changes	New analysis cannot expand the permitted destination; refuse the uncovered suffix or whole preparation
Runtime ceiling becomes 4,000	Effect analysis can remain identical	The 7,300-cent refund is no longer authorized
Interpreter is replaced	Effects might remain identical	Compatibility is insufficient unless the original formation authority permits the replacement
Refund ACK is lost	The caller lacks an outcome, not necessarily an effect	Query the committed occurrence; do not infer permission to refund again

Table 3: Different invalidation domains in one running example. These are semantic cases, not additional independent experimental observations.

Panel of Figure 1 — Figure 1: Proposed separation of authority, prospective evidence and observed effects. Only an admissible decision proceeds to effect-owner commitment; refusals do not commit effects. Evidence informs a decision but does not grant authority. This is not a claim that current AREG computes a complete prospective closure.

Obligation	Potentially reusable fact	Fact that must remain applicable at use
Effect coverage	Result of supported analysis	Relevant state, workflow, target and coverage profile
Grant authenticity	Verification of immutable signed bytes	Trusted issuer and applicable key lifecycle
Authority	Original bounded delegation	Current restriction, revocation and applicable lifecycle
Quota and order	Declared ceilings and trace rules	Shared residual budget and committed prefix
Replay integrity	Stable occurrence identity	Durable consumption state and unresolved prior outcome

Table 4: A cache hit is not an authorization decision. The prototype exercises a subset of these lifecycle conditions; it does not implement an enterprise key-rotation or distributed-revocation protocol.

Path	Preparation/admission	Intervening event	Effect-owner commitment
Admission only	Validate $g$ , issue receipt	State changes to $g+1$	Stale work may execute
Fenced path	Validate $g$ , reserve scope	State changes to $g+1$	Refuse stale generation; re-evaluate
Stable fast path	Reuse applicable bound; check authority	No relevant change	Consume once within current scope

Figure 2: Ordering, not a measured latency chart. “Fast” removes redundant analysis, not revocation or effect-owner checks. A receipt attached after an effect is not a preventive fence.

Strategy	Admits	Against label/29	Refused admissible/6	Analysis attempts
Identity-only ablation	14	8	0	0
Exact snapshot	3	0	3	0
Fresh analysis	5	0	1	22
Dependency-scoped	6	0	0	6

Table 5: Outputs of the abstract development model. Non-admission labels include deny and review, not only demonstrated harmful effects. Attempts include unavailable-summary branches; 20 fresh and 5 selective attempts select available summaries. No real analyzer, latency or CPU cost is measured.

Panel of Figure 3 — Figure 3: The Matoi reference path. Actual experiments use CAVA canonicalization, the BAF tuple matcher and the AREG graph builder. Signed grants and receipts instantiate the authority/proof role; this is not a claim that every PCAA service or production ZeroGate integration was exercised. Dashed flow denotes refusal without a new effect.

Arm	Request analyses	Including priming	Effects	Elapsed p95 (ms)
Always-fresh	420	820	340	78.161
Whole-snapshot cache	160	560	340	76.973
Dependency cache	140	540	340	77.450

Table 6: Local development measurements, not a throughput or SLA test. Each arm includes 400 separately timed cache-priming analyses, including unused priming in always-fresh. Elapsed timing begins after priming and registration and mixes completed and refused schedules; stratified values are retained in the artifact.

Leaves	Unread keys	Change	Fresh	Snapshot	Dependency
1	0	Stable	11.096	10.724	9.502
1	1	Irrelevant	10.992	22.896	9.610
1	0	Relevant	10.315	20.909	18.633
1	0	Workflow	14.586	27.169	20.265
1	4,096	Stable	1,367.917	4,760.271	1,486.138
1	4,097	Irrelevant	1,398.182	6,050.510	1,499.318

Table 7: Preparation microseconds per request: median of twelve epoch totals, each divided by sixteen and including priming. All four change classes at the smallest/largest workflow and base-state corners are shown; the artifact includes all 64 cells. These are not end-to-end durations or independent-quantile differences.

Panel of Figure 4 — Figure 4: Three diagnostic regimes from the fixed 64-cell study, shown as median paired epoch-cost ratios. A useful hit saves work, an expensive hit can lose, and a relevant-change miss can pay twice. These selected cells explain the mechanism; they are neither an overall average nor end-to-end speedups.

Schedule	POSTs / confirmed comments	Work-item outcome across both arms
Authorized	4 / 4	Two complete two-comment items
Irrelevant metadata churn	4 / 4	Two complete items; live authority checks retained
Revoked before release	0 / 0	Two refusals before dispatch
Runtime scope narrowed	0 / 0	Two whole-item refusals before dispatch
Absent callback added	0 / 0	Expanded consequences not admitted under old evidence/lease
Competing occurrences, one batch quota	4 / 4	One complete item per arm; the competing item refused

Table 8: Real GitHub pilot: ten schedules

\times

two preparation arms, one cell per schedule/arm. Counts combine both arms, whose scheduled outcomes agree. Confirmation includes provider readback after local confirmation loss; denials and duplicate responses are not extra effects.

Schedule	POSTs / effects	Final outcome across both arms
Ordinary completion	4 / 4	Two complete occurrences
Pending crash and recovery	4 / 4	Fresh checks precede resumed dispatch
Intent before HTTP, then crash	0 / 0	Two unknown prefixes; suffixes cancelled
Receiver commit before confirmation, then crash	2 / 2	Two prefixes reconciled; no resend or suffix
Revoke after first effect	2 / 2	Two second-step authority refusals
Duplicate admission	4 / 4	Two duplicates; no additional effect

Table 9: Local recovery campaign, one repetition per schedule/arm. Effects are actual receiver rows, not all confirmed steps. The duplication fixture deliberately violates the normal one-effect-per-POST provider assumption; detecting its ambiguity is not preventing its duplicate effects.

Case	Checked / protected cache	95% interval
Stable, cold one-occurrence	1.012	[1.004, 1.020]
Stable, eight occurrences	1.003	[0.991, 1.015]
Stable, 64 occurrences	1.004	[0.995, 1.014]
Unrelated drift, sixteen effects	0.991	[0.965, 1.011]
Unrelated drift, long reuse	0.999	[0.993, 1.004]
Relevant drift, sixteen effects	0.980	[0.933, 1.010]

Table 10: Full cell lifecycle cost at equal completed work, twenty paired blocks per row. Below one favors checked reuse. Eleven intervals include one; the remaining cold-start interval is more expensive. The 0.934 point estimate is not evidence of a demonstrated 6.6% speedup.

Arm at 400 offered/s	Offered	Completed	Capacity refusals
Reference-fresh	1,280	1,142	138
Reference-snapshot	1,280	1,152	128
Reference-cache	1,280	1,142	138
Checked-reuse	1,280	1,143	137

Table 11: Twenty short batches per arm at the highest frozen offered load. The eight-slot limit belongs to the harness, not a certified production queue. The lower rates complete all offered work. Refused work stays in the denominator; these unequal-completion cells do not produce an equal-work latency ranking.

Configuration	Cells	Qualified	Refused	Unauthorized effects
Independent owners	45	45	0	0
Shared atomic committer	45	45	0	0
Diamond routing and retry entry	45	45	0	0
Missing atomic hook	45	0	45	33
Activation failure	45	0	45	33
Declared raw writer	45	0	45	45

Table 12: Physical-oracle coverage and actual recorded effects, not just selector output. Refused configurations are still deliberately probed in diagnostic mode; their effects are not qualified deployment work. The falsely complete inventory incorrectly claims coverage in all 45 cells. The 45 explicitly unknown deployments are included in the 180 refusals.

Consumer	Repair/full whole-cell ratio	95% interval	Reduction
JS	0.895956	[0.889913, 0.902467]	10.40%
Python	0.837778	[0.832257, 0.842638]	16.22%

Table 13: Within-profile portable cost contrasts. These are neither the older repair experiment nor measurements of an integrated runtime.

Integrated strategy	102 sessions, total ms	Ordinary-session median ms
Portable full	11600.239037	101.561542
Portable repair	11499.018373	102.770250
Protected reference cache	11155.197332	99.158792

Table 14: Complete local sessions include startup, two preparations, dispatch, readback, diagnostics, prescribed recovery and shutdown. Six ordinary samples per arm and fixed scheduling do not establish a speed ranking or tail SLA.

Measure (per governed strategy)	Full	Repair
Original benign utility true	10/10	10/10
Exact observed benign messages	14/14	14/14
Specified boundary refusals	12/12	12/12
Unexpected benign refusals	0/10	0/10
Duplicate conservation checks	2/2	2/2
Phishing goal: attacker success	3/10	3/10

Table 15: Original AgentDojo plans with separately fixed route/byte policies. These are small prescribed sets, not estimated production error rates or full-benchmark attack-success rates.

Consumer	Arm	Total ms, 240 cells	Median cell ms
JS	explicit-full	18522.367782	77.859709
JS	compact-recheck	17105.576168	74.204875
JS	compact-reuse	16509.278753	71.049042
Python	explicit-full	26180.566832	99.724584
Python	compact-recheck	22253.153961	96.430250
Python	compact-reuse	21853.871456	94.158875

Table 16: New matched-cost campaign, not the earlier portable or integrated session measurements. A cell contains all twelve positions and the full producer/consumer lifecycle.

Whole-cell contrast	JS ratio [95% interval]	Python ratio [95% interval]
Reuse/recheck (primary)	0.965140 [0.961006, 0.970126]	0.982057 [0.980022, 0.984324]
Recheck/explicit	0.923509 [0.920503, 0.926710]	0.849987 [0.847535, 0.852425]
Reuse/explicit	0.891316 [0.888382, 0.894480]	0.834736 [0.832287, 0.837243]

Table 17: Ratios of summed paired-block costs. The 95% percentile intervals use 2,000 resamples of twenty complete blocks, seed 20261015. Aggregate resamples preserve all twelve families in each sampled block.

Family	JS reuse/recheck [95% interval]	Python reuse/recheck [95% interval]
literal	0.961108 [0.947811, 0.972368]	0.983028 [0.972238, 0.992822]
shared-scalar	0.901956 [0.891265, 0.911660]	0.951904 [0.942762, 0.959770]
sparse-scalar	0.942479 [0.936211, 0.948772]	0.981051 [0.972150, 0.992503]
dense-scalar	0.998362 [0.992436, 1.003878]	0.999539 [0.993786, 1.004502]
wide-irrelevant	0.970020 [0.956599, 0.984911]	0.984881 [0.978250, 0.990870]
branch-stable	0.966131 [0.936744, 1.012855]	0.969841 [0.962723, 0.977711]

Table 18: Every matched-cost family, twenty paired blocks each. Intervals are pointwise, not multiplicity-adjusted simultaneous intervals. All secondary family contrasts remain in the retained analysis.

Population / arm	Cells	Utility pre/post	New utility	Attacker post	Appends
All user sanity / unmediated	16	$7\to 16$	9	0	6
All attack sanity / unmediated	9	$0\to 0$	0	9	9
Eligible benign / full	5	$1\to 5$	4	0	5
Eligible benign / repair	5	$1\to 5$	4	0	5
Attack cross / unmediated	35	$7\to 7$	0	35	45
Attack cross / full	35	$7\to 7$	0	0	0

Table 19: Original Banking predicates and actual append counts. Pre/post are counts of predicates true before/after the target attempt, not success fractions. New utility counts only false-to-true transitions. Attacker predicates are false before every cell. No baseline score is corrected.

Population or control	First decisive layer / stage	Full cells	Repair cells
Original attack cross	Kernel / admission: recipient boundary	35	35
Revoke before admission	Kernel / admission: authority	5	5
Narrow before first claim	Kernel / claim: authority	5	5
Wrong recipient, fresh proof	Kernel / admission: boundary	5	5
Amount changed after prepare	Kernel / admission: preparation binding	5	5
Above-cap amount, fresh proof	Money adapter / after admission	5	5

Table 20: Every prescribed Banking control over all five eligible users. Five duplicate-control appends per arm mean one per control cell, not one per admission. No control is masked or excluded.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Study	Observational unit	What must not be inferred
Finite model	35 primary states plus one separate omitted-dependency counterexample	Independent semantic accuracy or real execution
macOS process campaign	1,260 records; 1,320 occurrences; 1,020 effects	1,260 independent workflow families
Azure process campaign	Same matrix: 1,260 records; 1,320 occurrences; 1,020 effects	A new semantic corpus or a production SLA
Preparation study	36,864 measured requests; 1,536 cached primes charged separately; 6,144 warmup requests	Full-workflow timing or free preparation
Receiver-evidence campaign	48 records; 96 expected occurrences; 54 confirmed effects; 24 denied attempts; six reconciliations	Denials or reconciliations as additional effects
Software regression	223 combined Matoi/AREG tests; cost-study tests separate	223 independent attacks or experimental records

Appendix

Table 21: Denominators are not interchangeable. All experimental labels and replays are internal; repetitions assess implementation behavior and timing variability, not independent generalization.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 276 papers

Oct 25, 2026

AgentProofBench: Benchmarking Reusable Verifiers for Web Agents

Reusable Web-agent verification requires a rule to follow changing requirements and support subsequent execution. We introduce AgentProofBench, which connects paired tests of a frozen acceptance rule to execution from identical saved openings. The resource spans 97 tasks, 79 families, and four Web services. Experiments with DeepSeek Flash/Pro establish two linked measurements. Across 48 families, complete-panel and decision-replay tests retain 82/96 Flash and 79/96 Pro source programs; paired reuse-rebuild BA intervals are [-5.47, 1.57] and [-10.16, 0.00] percentage points. Across 22 execution families, deployment-state panel correctness separates program assignments whose two saved openings are both delivered correctly: 32/33 assignments with error-free panels, versus 1/11 with panel errors. All reference-defined program-gate regressions and withheld deliveries occur in the latter group. Neutral continuation attains the highest correct delivery under the tested generic feedback, providing a concrete baseline for measuring the value added by a gate. Released instructions, states, programs, reference rules, and trajectories connect each test failure to its execution consequences. AgentProofBench makes reusable verification assessable at both the requirement and policy levels.

Jingjie Ning, Xueqi Li, Yi Lu +1

LLM Agent Verification Web Agent Benchmarks Automated Agent Evaluation

Ask PDF

Sep 29, 2026

Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing

Tool-using agents can expose citations and execution logs while leaving a critical association unaudited: whether the claim shown to a user is the claim emitted by the committed execution and supported by the cited source. A valid citation and a valid trace can therefore remain individually well formed while being transplanted across claims, actions, runs, or source versions. We introduce a claim-anchored execution contract that jointly binds the emitted claim, its exact source span, the ordered execution prefix that produced it, and the source version and access state observed by that execution. Each receipt contains an emission anchor that deterministically locates the claim inside a committed answer or claim-bearing action, together with source identifiers, offsets, hashes, quotes, and a domain-separated execution commitment. A deterministic integrity verifier reconstructs these bindings before semantic or task labels are joined. We separate this integrity plane from a pluggable support plane, so structural validity is not used as a proxy for entailment. The contract exposes seven independently testable properties: claim-emission binding, source binding, ordered-execution binding, oracle separation, persisted-object replay, execution-rerun consistency, and version/access binding. Across 1,280 cross-object attacks, the joint contract detects 1,275 substitutions (0.9961). Removing a targeted property reduces its attack-detection rate to 0.0156-0.0625. On an independently adjudicated 384-pair split, the conflict-aware support guard reaches F1 0.8865 and false acceptance 0.0729; on unseen failure families, these rates are 0.8679 and 0.0938.

Miaobo Hu, Shuhao Hu, Xiaobo Guo +4

School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, China · Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China

AI Agent Auditing Citation Verification Claim Verification Data Provenance Tamper-Evident Logging

Ask PDF

Oct 11, 2026

Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways

Distributed agent workflows cache delegated authority at tool gateways. Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped. We define C0-C5, a bounded outcome contract spanning issuer commit through effect prevention, and implement it as a persistent monitor over a frozen gateway set, call set, and observation window. A 14-case fault matrix checks conservative classification, sticky violations, restart persistence, and evidence immutability. In a derived audit of its eight semantic cases, treating C3 or C4 as completion produces seven or five false positives, respectively; the bounded C0-C5 verdict produces none. Descriptive scaling covers 1,024 gateways and 10,000 effect vectors. The primary experiment uses the maintained Keycloak 26.7 identity server and measures the contract across two durable receivers, eight physical agent-tool gateways, Filesystem and PostgreSQL effects, and 16 AWS hosts in three availability zones. Normal delivery and recovery commit no effects. Under receiver-selective non-delivery, transport acknowledgment and receiver persistence still succeed, but 112 of 225 calls (49.78%) are admitted, and all 112 effects commit in every treatment block. A separately provisioned execution repeats the result. OPA/Toxiproxy and a live three-role LLM workflow with networked MCP tools reproduce the persisted-but-not-enforced boundary on narrower surfaces. Finally, an unmodified external MCPMark agent executes 60 closed-loop task arms. Normal C4 denies all 31 exposed post-barrier calls and commits no effect; selective C3 allows 344 calls and commits 145 effects across Filesystem and PostgreSQL. Transport success is therefore evidence of progress, not a revocation-completion verdict.

Lifei Liu, Haoran Yu, Danping Zhang

Independent Researcher Seattle, WA, USA · Nanchang Hangkong University Nanchang, China

Runtime Enforcement for AI Agents Access Control Tool Access Control for LLM Agents AI Agent Monitoring AI Agent Auditing

Ask PDF

Abstract

Runtime Enforcement for AI Agents

Explore similar work

AgentProofBench: Benchmarking Reusable Verifiers for Web Agents

Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing

Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways