cs.CROct 15, 2026
SaveMatoi: Selective Revalidation of Consequence Evidence for Agent Authorization
Organizations: Ond Holdings Inc. Toronto, Ontario, Canada
Abstract
Matoi separates reusable consequence evidence from current execution authority and durable occurrence history. Its finite query-aware contract covers branches, ordered collections and negative lookups. A consumer reuses only its own checked evidence whose observations remain valid; signed requests, live grants, quota and uncertain outcomes remain separate obligations. Conditional correctness arguments distinguish locally serialized claims from nontransactional remote effects. Two studies strengthen cost attribution and domain evaluation. A 1,440-cell matched-wire study repeats 144 authored inputs. With compact input bytes identical, reuse reduces complete lifecycle cost by 3.49 percent in JS and 1.79 percent in Python. Combined representation/reuse reductions against full proof are 10.87 and 16.53 percent; five of twelve family intervals for the matched comparison cross one in each language. A prospectively frozen AgentDojo Banking mapping covers 5/16 user plans and 7/9 attack plans. Both governed strategies preserve five exact benign transfers and refuse 35 reused attack-plan/policy crosses. Pre-satisfied utility predicates are reported separately from completed work. These are original scripted synthetic tools, not autonomous agents or a real bank. Earlier studies retain cheaper protected-cache alternatives, policy-compatible phishing, provider duplication and post-claim revocation. Separate JS/Python consumers establish finite-profile interoperability within the same project; durable recovery rechecks evidence and retains uncertain reservations. The results support a bounded, auditable reuse and execution contract, not a new general incremental algorithm, arbitrary-tool closure, atomic third-party commitment or production superiority.
Figures & tables
| Prior framing | Obligation retained | Question examined here |
|---|---|---|
| Approval laundering | Represent and contain transitive consequences | When may an existing bounded consequence analysis remain applicable after a state change? |
| Formation-consistent dispatch | Effect compatibility does not grant interpreter authority | Can evidence refresh preserve the original authorized target and delegation? |
| Capability attenuation | Caveats restrict rather than manufacture authority | How are a fixed grant and changing evidence kept distinct at execution? |
| Incremental computation | Reuse needs dependency correctness and a cost model | Which reusable computation is evidence, and which live checks cannot be replaced by that computation? |
| Reference monitors | Every covered effect must cross the protection boundary | Which mutation and authority update share the declared serialization point? |
Table 1: Claim-by-claim comparison. Typed effects, attenuation, dependency tracking and final enforcement are established ideas. The investigated contribution is their explicit applicability contract and measured trade-off, not a claim of inventing those mechanisms.
| Evidence design | Trust and deployment obligation |
|---|---|
| Trusted full evaluation | Trust a complete local evaluator for each snapshot; no untrusted producer certificate is required. |
| Protected caching / incrementality | Keep complete dependency tracking, retained computations and invalidation state inside the trusted boundary. |
| Compact complete rechecking | Accept untrusted references only into the consumer’s checked root, then rederive every resolved rule. |
| Untrusted-producer checked reuse | Protect the same custody; check replacement rules and current applicability of retained subtrees before accepting the root. |
Table 2: Trust/baseline comparison. All designs still need live authority and occurrence checks. Measured comparators are same-project implementations and internal ablations; no measured external-baseline advantage is established.
| Change after preparation | Evidence consequence | Authorization consequence |
|---|---|---|
| Dashboard theme changes | Supported dependency projection is unchanged | Bound can be reused; fresh authority and budget checks remain |
| Refund becomes 5,000 cents | Relevant operand changes; recompute the effect | May remain within an explicitly delegated grant; a new occurrence still consumes its own budget |
| Notification points outside | Relevant destination changes | New analysis cannot expand the permitted destination; refuse the uncovered suffix or whole preparation |
| Runtime ceiling becomes 4,000 | Effect analysis can remain identical | The 7,300-cent refund is no longer authorized |
| Interpreter is replaced | Effects might remain identical | Compatibility is insufficient unless the original formation authority permits the replacement |
| Refund ACK is lost | The caller lacks an outcome, not necessarily an effect | Query the committed occurrence; do not infer permission to refund again |
Table 3: Different invalidation domains in one running example. These are semantic cases, not additional independent experimental observations.
Figure 1: Proposed separation of authority, prospective evidence and observed effects. Only an admissible decision proceeds to effect-owner commitment; refusals do not commit effects. Evidence informs a decision but does not grant authority. This is not a claim that current AREG computes a complete prospective closure.
| Obligation | Potentially reusable fact | Fact that must remain applicable at use |
|---|---|---|
| Effect coverage | Result of supported analysis | Relevant state, workflow, target and coverage profile |
| Grant authenticity | Verification of immutable signed bytes | Trusted issuer and applicable key lifecycle |
| Authority | Original bounded delegation | Current restriction, revocation and applicable lifecycle |
| Quota and order | Declared ceilings and trace rules | Shared residual budget and committed prefix |
| Replay integrity | Stable occurrence identity | Durable consumption state and unresolved prior outcome |
Table 4: A cache hit is not an authorization decision. The prototype exercises a subset of these lifecycle conditions; it does not implement an enterprise key-rotation or distributed-revocation protocol.
| Path | Preparation/admission | Intervening event | Effect-owner commitment |
|---|---|---|---|
| Admission only | Validate , issue receipt | State changes to | Stale work may execute |
| Fenced path | Validate , reserve scope | State changes to | Refuse stale generation; re-evaluate |
| Stable fast path | Reuse applicable bound; check authority | No relevant change | Consume once within current scope |
Figure 2: Ordering, not a measured latency chart. “Fast” removes redundant analysis, not revocation or effect-owner checks. A receipt attached after an effect is not a preventive fence.
| Strategy | Admits | Against label/29 | Refused admissible/6 | Analysis attempts |
|---|---|---|---|---|
| Identity-only ablation | 14 | 8 | 0 | 0 |
| Exact snapshot | 3 | 0 | 3 | 0 |
| Fresh analysis | 5 | 0 | 1 | 22 |
| Dependency-scoped | 6 | 0 | 0 | 6 |
Table 5: Outputs of the abstract development model. Non-admission labels include deny and review, not only demonstrated harmful effects. Attempts include unavailable-summary branches; 20 fresh and 5 selective attempts select available summaries. No real analyzer, latency or CPU cost is measured.
Figure 3: The Matoi reference path. Actual experiments use CAVA canonicalization, the BAF tuple matcher and the AREG graph builder. Signed grants and receipts instantiate the authority/proof role; this is not a claim that every PCAA service or production ZeroGate integration was exercised. Dashed flow denotes refusal without a new effect.
| Arm | Request analyses | Including priming | Effects | Elapsed p95 (ms) |
|---|---|---|---|---|
| Always-fresh | 420 | 820 | 340 | 78.161 |
| Whole-snapshot cache | 160 | 560 | 340 | 76.973 |
| Dependency cache | 140 | 540 | 340 | 77.450 |
Table 6: Local development measurements, not a throughput or SLA test. Each arm includes 400 separately timed cache-priming analyses, including unused priming in always-fresh. Elapsed timing begins after priming and registration and mixes completed and refused schedules; stratified values are retained in the artifact.
| Leaves | Unread keys | Change | Fresh | Snapshot | Dependency |
|---|---|---|---|---|---|
| 1 | 0 | Stable | 11.096 | 10.724 | 9.502 |
| 1 | 1 | Irrelevant | 10.992 | 22.896 | 9.610 |
| 1 | 0 | Relevant | 10.315 | 20.909 | 18.633 |
| 1 | 0 | Workflow | 14.586 | 27.169 | 20.265 |
| 1 | 4,096 | Stable | 1,367.917 | 4,760.271 | 1,486.138 |
| 1 | 4,097 | Irrelevant | 1,398.182 | 6,050.510 | 1,499.318 |
Table 7: Preparation microseconds per request: median of twelve epoch totals, each divided by sixteen and including priming. All four change classes at the smallest/largest workflow and base-state corners are shown; the artifact includes all 64 cells. These are not end-to-end durations or independent-quantile differences.
Figure 4: Three diagnostic regimes from the fixed 64-cell study, shown as median paired epoch-cost ratios. A useful hit saves work, an expensive hit can lose, and a relevant-change miss can pay twice. These selected cells explain the mechanism; they are neither an overall average nor end-to-end speedups.
| Schedule | POSTs / confirmed comments | Work-item outcome across both arms |
|---|---|---|
| Authorized | 4 / 4 | Two complete two-comment items |
| Irrelevant metadata churn | 4 / 4 | Two complete items; live authority checks retained |
| Revoked before release | 0 / 0 | Two refusals before dispatch |
| Runtime scope narrowed | 0 / 0 | Two whole-item refusals before dispatch |
| Absent callback added | 0 / 0 | Expanded consequences not admitted under old evidence/lease |
| Competing occurrences, one batch quota | 4 / 4 | One complete item per arm; the competing item refused |
Table 8: Real GitHub pilot: ten schedules two preparation arms, one cell per schedule/arm. Counts combine both arms, whose scheduled outcomes agree. Confirmation includes provider readback after local confirmation loss; denials and duplicate responses are not extra effects.
| Schedule | POSTs / effects | Final outcome across both arms |
|---|---|---|
| Ordinary completion | 4 / 4 | Two complete occurrences |
| Pending crash and recovery | 4 / 4 | Fresh checks precede resumed dispatch |
| Intent before HTTP, then crash | 0 / 0 | Two unknown prefixes; suffixes cancelled |
| Receiver commit before confirmation, then crash | 2 / 2 | Two prefixes reconciled; no resend or suffix |
| Revoke after first effect | 2 / 2 | Two second-step authority refusals |
| Duplicate admission | 4 / 4 | Two duplicates; no additional effect |
Table 9: Local recovery campaign, one repetition per schedule/arm. Effects are actual receiver rows, not all confirmed steps. The duplication fixture deliberately violates the normal one-effect-per-POST provider assumption; detecting its ambiguity is not preventing its duplicate effects.
| Case | Checked / protected cache | 95% interval |
|---|---|---|
| Stable, cold one-occurrence | 1.012 | [1.004, 1.020] |
| Stable, eight occurrences | 1.003 | [0.991, 1.015] |
| Stable, 64 occurrences | 1.004 | [0.995, 1.014] |
| Unrelated drift, sixteen effects | 0.991 | [0.965, 1.011] |
| Unrelated drift, long reuse | 0.999 | [0.993, 1.004] |
| Relevant drift, sixteen effects | 0.980 | [0.933, 1.010] |
Table 10: Full cell lifecycle cost at equal completed work, twenty paired blocks per row. Below one favors checked reuse. Eleven intervals include one; the remaining cold-start interval is more expensive. The 0.934 point estimate is not evidence of a demonstrated 6.6% speedup.
| Arm at 400 offered/s | Offered | Completed | Capacity refusals |
|---|---|---|---|
| Reference-fresh | 1,280 | 1,142 | 138 |
| Reference-snapshot | 1,280 | 1,152 | 128 |
| Reference-cache | 1,280 | 1,142 | 138 |
| Checked-reuse | 1,280 | 1,143 | 137 |
Table 11: Twenty short batches per arm at the highest frozen offered load. The eight-slot limit belongs to the harness, not a certified production queue. The lower rates complete all offered work. Refused work stays in the denominator; these unequal-completion cells do not produce an equal-work latency ranking.
| Configuration | Cells | Qualified | Refused | Unauthorized effects |
|---|---|---|---|---|
| Independent owners | 45 | 45 | 0 | 0 |
| Shared atomic committer | 45 | 45 | 0 | 0 |
| Diamond routing and retry entry | 45 | 45 | 0 | 0 |
| Missing atomic hook | 45 | 0 | 45 | 33 |
| Activation failure | 45 | 0 | 45 | 33 |
| Declared raw writer | 45 | 0 | 45 | 45 |
Table 12: Physical-oracle coverage and actual recorded effects, not just selector output. Refused configurations are still deliberately probed in diagnostic mode; their effects are not qualified deployment work. The falsely complete inventory incorrectly claims coverage in all 45 cells. The 45 explicitly unknown deployments are included in the 180 refusals.
| Consumer | Repair/full whole-cell ratio | 95% interval | Reduction |
|---|---|---|---|
| JS | 0.895956 | [0.889913, 0.902467] | 10.40% |
| Python | 0.837778 | [0.832257, 0.842638] | 16.22% |
Table 13: Within-profile portable cost contrasts. These are neither the older repair experiment nor measurements of an integrated runtime.
| Integrated strategy | 102 sessions, total ms | Ordinary-session median ms |
|---|---|---|
| Portable full | 11600.239037 | 101.561542 |
| Portable repair | 11499.018373 | 102.770250 |
| Protected reference cache | 11155.197332 | 99.158792 |
Table 14: Complete local sessions include startup, two preparations, dispatch, readback, diagnostics, prescribed recovery and shutdown. Six ordinary samples per arm and fixed scheduling do not establish a speed ranking or tail SLA.
| Measure (per governed strategy) | Full | Repair |
|---|---|---|
| Original benign utility true | 10/10 | 10/10 |
| Exact observed benign messages | 14/14 | 14/14 |
| Specified boundary refusals | 12/12 | 12/12 |
| Unexpected benign refusals | 0/10 | 0/10 |
| Duplicate conservation checks | 2/2 | 2/2 |
| Phishing goal: attacker success | 3/10 | 3/10 |
Table 15: Original AgentDojo plans with separately fixed route/byte policies. These are small prescribed sets, not estimated production error rates or full-benchmark attack-success rates.
| Consumer | Arm | Total ms, 240 cells | Median cell ms |
|---|---|---|---|
| JS | explicit-full | 18522.367782 | 77.859709 |
| JS | compact-recheck | 17105.576168 | 74.204875 |
| JS | compact-reuse | 16509.278753 | 71.049042 |
| Python | explicit-full | 26180.566832 | 99.724584 |
| Python | compact-recheck | 22253.153961 | 96.430250 |
| Python | compact-reuse | 21853.871456 | 94.158875 |
Table 16: New matched-cost campaign, not the earlier portable or integrated session measurements. A cell contains all twelve positions and the full producer/consumer lifecycle.
| Whole-cell contrast | JS ratio [95% interval] | Python ratio [95% interval] |
|---|---|---|
| Reuse/recheck (primary) | 0.965140 [0.961006, 0.970126] | 0.982057 [0.980022, 0.984324] |
| Recheck/explicit | 0.923509 [0.920503, 0.926710] | 0.849987 [0.847535, 0.852425] |
| Reuse/explicit | 0.891316 [0.888382, 0.894480] | 0.834736 [0.832287, 0.837243] |
Table 17: Ratios of summed paired-block costs. The 95% percentile intervals use 2,000 resamples of twenty complete blocks, seed 20261015. Aggregate resamples preserve all twelve families in each sampled block.
| Family | JS reuse/recheck [95% interval] | Python reuse/recheck [95% interval] |
|---|---|---|
| literal | 0.961108 [0.947811, 0.972368] | 0.983028 [0.972238, 0.992822] |
| shared-scalar | 0.901956 [0.891265, 0.911660] | 0.951904 [0.942762, 0.959770] |
| sparse-scalar | 0.942479 [0.936211, 0.948772] | 0.981051 [0.972150, 0.992503] |
| dense-scalar | 0.998362 [0.992436, 1.003878] | 0.999539 [0.993786, 1.004502] |
| wide-irrelevant | 0.970020 [0.956599, 0.984911] | 0.984881 [0.978250, 0.990870] |
| branch-stable | 0.966131 [0.936744, 1.012855] | 0.969841 [0.962723, 0.977711] |
Table 18: Every matched-cost family, twenty paired blocks each. Intervals are pointwise, not multiplicity-adjusted simultaneous intervals. All secondary family contrasts remain in the retained analysis.
| Population / arm | Cells | Utility pre/post | New utility | Attacker post | Appends |
|---|---|---|---|---|---|
| All user sanity / unmediated | 16 | 9 | 0 | 6 | |
| All attack sanity / unmediated | 9 | 0 | 9 | 9 | |
| Eligible benign / full | 5 | 4 | 0 | 5 | |
| Eligible benign / repair | 5 | 4 | 0 | 5 | |
| Attack cross / unmediated | 35 | 0 | 35 | 45 | |
| Attack cross / full | 35 | 0 | 0 | 0 |
Table 19: Original Banking predicates and actual append counts. Pre/post are counts of predicates true before/after the target attempt, not success fractions. New utility counts only false-to-true transitions. Attacker predicates are false before every cell. No baseline score is corrected.
| Population or control | First decisive layer / stage | Full cells | Repair cells | Appends/arm |
|---|---|---|---|---|
| Original attack cross | Kernel / admission: recipient boundary | 35 | 35 | 0 |
| Revoke before admission | Kernel / admission: authority | 5 | 5 | 0 |
| Narrow before first claim | Kernel / claim: authority | 5 | 5 | 0 |
| Wrong recipient, fresh proof | Kernel / admission: boundary | 5 | 5 | 0 |
| Amount changed after prepare | Kernel / admission: preparation binding | 5 | 5 | 0 |
| Above-cap amount, fresh proof | Money adapter / after admission | 5 | 5 | 0 |
Table 20: Every prescribed Banking control over all five eligible users. Five duplicate-control appends per arm mean one per control cell, not one per admission. No control is masked or excluded.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
| Study | Observational unit | What must not be inferred |
|---|---|---|
| Finite model | 35 primary states plus one separate omitted-dependency counterexample | Independent semantic accuracy or real execution |
| macOS process campaign | 1,260 records; 1,320 occurrences; 1,020 effects | 1,260 independent workflow families |
| Azure process campaign | Same matrix: 1,260 records; 1,320 occurrences; 1,020 effects | A new semantic corpus or a production SLA |
| Preparation study | 36,864 measured requests; 1,536 cached primes charged separately; 6,144 warmup requests | Full-workflow timing or free preparation |
| Receiver-evidence campaign | 48 records; 96 expected occurrences; 54 confirmed effects; 24 denied attempts; six reconciliations | Denials or reconciliations as additional effects |
| Software regression | 223 combined Matoi/AREG tests; cost-study tests separate | 223 independent attacks or experimental records |
Table 21: Denominators are not interchangeable. All experimental labels and replays are internal; repetitions assess implementation behavior and timing variability, not independent generalization.
More in this topic
Runtime Enforcement for AI Agents
Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.
See all 276 papers