arXiv CSopen access

Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents

arXiv:2607.23586v1 [cs.AI] 26 Jul 2026

Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents Zhaoxi Zhang

Xiaomei Zhang

University of Technology Sydney [email protected]

Griffith University [email protected]

Abstract—Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. This improves adaptation but creates a distinct authorization problem. Tool-enabled agents can turn model errors and prompt injections into consequential external actions; when evolution occurs under a live grant, the subject exercising that authority or the context in which it acts may no longer match what the user evaluated. Evolution can change both the effects reachable under an old grant and the authority required by the task, which may rise, fall, or become incomparable. Existing tool policies constrain actions but do not determine when a grant survives this change. We formulate authorization continuity: when does an existing grant remain valid, how may active authority change, and what boundary must never move? Our state-bound model fixes a transition envelope and an immutable effect ceiling at grant time. The envelope determines whether the grant survives a mutation; below the ceiling, authority may contract freely and expand only under specified evidence conditions. We distinguish requested from realized effects and prove that, under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling. Agent-produced evidence may allocate authority below the ceiling but cannot raise it. Finally, we map six mutation classes to their authorization consequences.

I. I NTRODUCTION Agents deployed for open-ended, long-lived work cannot be configured in advance for every task, tool, failure mode, or change in their operating context. Knowledge becomes outdated, new services appear, users develop local conventions, and longhorizon tasks expose errors that were not represented during training. This limitation motivates lifelong and self-evolving agents that adapt after deployment by retaining feedback, extracting reusable experience, accumulating skills, or revising their own control logic [1], [2]. Reflexion stores linguistic feedback in episodic memory, ExpeL distills experience across tasks, and Voyager accumulates executable skills through interaction [3]–[5]. Automated Design of Agentic Systems, Gödel Agent, and the Darwin Gödel Machine extend adaptation to prompts, workflows, agent code, or the improvement process itself [6]–[8]. Across these mechanisms, evolution is a practical response to a common bottleneck: a useful long-lived agent must learn from interaction rather than repeatedly start from its deployment-time state.

BEFORE

EVOLUTION λ

AFTER

Agent S0

memory +

Agent S1

required authority

network tool +

file read

local exec

test → deploy

network

deploy

file read

local exec

proposal FIXED CEILING

EXPANSION GATE admit transition ✓

evidence ✓

active authority

× deny / suspend

Fig. 1. An example mutation stores new memory, adds a network tool, and enters deployment, expanding the authority needed by the task. The changed need produces only a proposal: expansion requires both transition compatibility and admissible evidence. Active authority remains inside the ceiling fixed at grant time; failure of either guard denies the expansion or suspends the grant.

These gains arrive against an already fragile security baseline: deployed LLMs remain vulnerable to adversarial attacks [9]–[14], and tool-enabled agents raise the stakes because model-generated decisions can read sensitive data, modify external state, and trigger consequential actions [15]–[17]. Evolution adds a further complication: it may change the subject exercising an existing grant or the authorization context in which that grant is used. A user authorizes an agent under particular memory, tools, workflow, task, expected effects, and enforcement conditions. Suppose a coding agent authorized to diagnose a test failure later stores untrusted tool output as a reusable rule, replaces a local test routine with a networkbacked skill, or delegates the next phase to a release subagent. If the session grant persists, the evolved state can inherit repository, network, credential, or deployment authority even though the user evaluated only its predecessor. The security problem therefore appears as soon as mutation and authorization overlap in time: when does an old grant remain valid, how may active authority change, and what boundary must no evolution cross? We use evolution for this broad phenomenon and mutation for one concrete state transition within it. The relevant state includes persistent memory, instructions, skills, tools, work-

flow code, delegation structure, task phase, and enforcement Existing authorization work provides important pieces of the configuration, not only model weights. Some mutations occur solution. Tool policies constrain calls and arguments, typed across generations; others occur while one user grant and or capability-based systems restrict effect flow, skill policies one session credential remain active. Evolution also converts bind permissions to reusable artifacts, and capability binding transient inputs into durable control state: repository content, invalidates grants when a manifest changes [16], [22], [25]– tool output, or web data can be distilled into memory, a skill, or [27]. These mechanisms primarily ask what a policy permits a modified workflow that affects later protected actions. Recent or whether a named capability remains present. They do not studies find that even benign experience can reduce safety by themselves answer whether an unchanged policy remains in high-risk settings, that locally correct experiences can be valid after memory, workflow, model, delegation, enforcement, poisoned into harmful general rules, and that malicious skills or task-phase evolution. The missing object is authorization or memory entries can create persistent influence [18]–[21]. continuity: a rule for deciding when an old grant survives These results establish risks to evolving behavior; our concern mutation of the authorized subject or context and how much is the additional amplification that occurs when the changed authority may be active afterward. behavior inherits authority granted to an earlier state. We separate three questions that are often conflated: Authorization can drift along two distinct dimensions. First, 1) Did the agent or task change in a way relevant to this evolution can expand the effects reachable under an unchanged grant? grant; capability-binding work independently motivates revali2) If the grant remains valid, what authority should be active dation after tool-manifest changes [22]. Second, evolution can now? change the authority actually needed to complete the task. The 3) What authority can no runtime evidence ever exceed? need can increase when a new plan adds a remote service, decrease when a learned local routine replaces one, or become The first is a continuity question. The second is an allocation incomparable when alternative valid plans require different question. The third is the security boundary. effect types. Most sharply, it can change without any agent Our answer separates two guards that respond to different component or tool manifest changing at all: moving from failures. A transition envelope states which mutations the editing and testing to pushing or deployment introduces a more old grant may survive; crossing it suspends the grant even consequential effect solely because the task entered a new if the currently requested effect remains small. An immutable phase. The directional claims and the phase-only case are our effect ceiling bounds all authority available under the grant; authorization inference and are formalized by Proposition 3; no observation generated during the session may raise it. we do not attribute them to the evolving-agent literature. Within that ceiling, active authority may contract freely and This creates a three-way tension that static authorization expand only when specified evidence conditions hold. This cannot resolve. A broad session grant preserves task completion allows adaptation without forcing competence evidence to carry but conflicts with least privilege and silently transfers excess an adversarial security guarantee that it cannot support. The authority to later versions of the principal [23], [24]. A separation yields the central design obligation: narrow immutable grant preserves the boundary but eventually A system may condition authority on demonstrated performance prevents a useful evolving agent from completing work, or only if it also fixes a bound that no performance can move. recreates repeated confirmation and its associated consent fatigue [24]. Existing privilege-control work correspondingly Contributions. treats automatic narrowing differently from policy expansion, • We formulate authorization continuity for evolving agents as a grant-relative transition-validity guard, distinct from which requires a stronger approval path [25]. Our additional effect containment. threat-model inference is that automatically tracking the agent’s claimed need is not such a path: it lets mutable agent • We define conditional authority beneath an immutable state participate in justifying its own privilege expansion ceiling: descent is free, ascent is evidence-gated, and no (Section V-C and Appendix B3). Thus neither a static grant runtime evidence can move the user-issued boundary. nor an adjustment controlled by the evolving agent is sufficient. • We give a non-amplification result that distinguishes reThe design goal is conditional authority change beneath a quested from realized effects and states the closure-sound boundary fixed outside the evolution process. monitor-view obligation explicitly. Neither higher competence nor successful past behavior • We map evolution mechanisms to authorization conseresolves this problem. Competence evidence says whether an quences and systematize six mutation classes that make agent is likely to use authority effectively; it does not establish the problem empirically testable. that the agent resists injection, that a new tool preserves an old effect boundary, or that a descendant should inherit the parent’s II. E VOLVING AGENTS AND AUTHORIZATION D RIFT trust. Moreover, task outcomes, tests, error rates, and execution histories are often produced by the same session that benefits A. What Evolves from an authority increase. They may be useful reliability We model the authorized subject as a model plus its signals, but treating them as the only security boundary gives harness: instructions, planning loop, memory, tools, skills, the beneficiary partial control over its own privilege. hooks, and delegation interfaces. This is the security principal

whose evolution the Introduction motivates. Treating only the C. Trusted Computing Base underlying model as the principal would miss changes to the An external monitor mediates protected effects, stores grants, mechanisms that select, parameterize, and execute its actions. and cannot be modified by the agent authority it enforces. The We distinguish subject mutation from authorization-context model, instructions, memory, skills, generated code, tools, and mutation. The former changes the model or harness; the latter subagents may be adversarial. The monitor sees an abstraction changes the task phase, trust context, or enforcement conditions Ŝ , not the full state S . The abstraction is sufficient only if t t under which the subject acts. Either can make an old grant the monitor-verified request remains a sound bound: stale, so the state monitored below contains both even though only the former changes the principal itself. Eff(St , a) ⊆ Req(a). (1) For authorization, the many evolution surfaces can be This is a semantic obligation on the monitor view and its compressed into three distinct dimensions: enforcement, not an assumption that Ŝt = St . Unobserved • Competence: what the agent can infer or plan. mutation is one way to violate it. • Affordance: what actions the harness makes expressible, D. Attacker Model such as a file or deployment tool. The attacker may control ingested content, skills, remote • Authority: what effects the surrounding system will actually tools, and memory, and may thereby steer the agent’s behavior permit on the user’s behalf. Evolution can change any of the three, but only authority [19]–[21], [29]. The attacker does not control the external determines which protected effects the runtime permits. An monitor or user-issued ceilings. We consider two successes: an increase in competence does not itself justify an increase in effect outside all user-issued ceilings, or reuse of a grant after an incompatible transition even when effects remain inside the the security boundary. ceiling. Side channels, monitor implementation defects, and information-flow confidentiality are outside scope. B. Scope and Non-Goals Our scope is delegated authority over externally observable effects while agent or task state changes. Mutation may be benign, adversarial, or an unintended consequence of optimizing task success [19], [28]. We do not solve model alignment, infer latent user intent, or require a new dialog after every prompt or model update. We ask only whether an old grant remains usable and what effects it can bound before the next protected action. III. S YSTEM AND T HREAT M ODEL A. Mutable Agent State Let St denote the grant-relevant state at time t. It combines the authorized subject (model identity, harness control state, persistent memory, capability configuration, and delegation) with its authorization context, including task phase and enforcement state. We do not expose these components as separate symbols in the main text because the monitor need only classify their changes relative to a grant. A session evolves through labeled λ transitions St − → St+1 . A label names a security-relevant class, such as skill loading, tool addition, subagent creation, or entry into a deployment phase. B. Executions, Labels, and Effects For an action a, Req(a) is the monitor-verified set of protected effects requested at its boundary. Eff(S, a) is the set actually produced when a executes in state S. The distinction matters because a changed tool implementation or harness may realize more than its nominal call suggests. Effects include a type and the resources touched, for example a local file update on a repository path or a remote update to a named branch.

IV. W HEN E VOLUTION C HANGES AUTHORITY The authority need of a task state is the family of protectedeffect sets under which at least one completing plan exists. It need not have a unique minimum because alternative plans may require incomparable resources or effect types. Evolution changes this family when it adds or removes effectful steps, changes the available completing plans, or moves the task to a phase with different consequences. Skills, workflows, memory, curricula, and agent compositions can all evolve in these ways [1], [5], [6], [8]. The authorization consequences below are our inference from those mechanisms rather than claims made by the cited systems. Need may rise, fall, become incomparable, or remain unchanged. Replacing a local test runner with one that reports to a remote service adds network transmission to every completing plan and raises a minimal requirement. Replacing a networked check with a local analyzer can lower it. Two alternative valid plans can instead require incomparable resources, such as access to a local secret or to a remote service. Appendix Proposition 3 formalizes these directions and the phase-only case. Most sharply, need can change without any subject mutation. Moving from editing and testing to pushing a branch introduces a remote update while the model, harness, and capability manifest remain bit-identical. Task phase is therefore part of the authorization context, not merely application metadata. Conversely, a model upgrade may leave required and reachable effects unchanged while still crossing a transition envelope that binds the grant to a provider or trust class. The appropriate response is consequently grant-relative: recompute active authority when required effects change, suspend when a continuity condition fails, and otherwise preserve the grant.

WITHIN CEILING

INSIDE ENVELOPE

OUTSIDE ENVELOPE

EXCEEDS CEILING

Admit

Clamp

no user event

no user event

Suspend

Suspend

core continuity case

user event

Fig. 2. The transition envelope decides whether the grant survives, while the ceiling determines how much authority may remain active. The highlighted cell is the paper’s central continuity case: effects remain bounded, but the subject or context no longer matches the grant.

V. A M INIMAL S TATE -B OUND AUTHORIZATION M ODEL A. Fixed Boundary, Conditional Authority A grant G fixes three things at authorization time: an effect ceiling B, an initial active authority P0 ⊆ B, and a transition envelope listing the mutation classes that the grant may survive. The ceiling is a set of protected effects. A structured implementation may encode that set with resource and effect-type fields while carrying budgets, goals, phases, and delegation constraints alongside it. At time t, the runtime proposes Ptprop . Contraction is always permitted. An expansion or an incomparable change requires the grant’s evidence condition. In every case the monitor applies one clamp: Pt = Ptprop ∩ B. (2) Only a new user grant can replace B. Evidence may therefore determine which part of a previously consented boundary is active, but cannot enlarge the boundary. The transition envelope is independent of this order. Let AliveG (t) mean that every mutation label observed since grant G was issued belongs to its envelope. If it is false, the monitor suspends the grant before the next protected action, even when Pt ⊆ B still holds. This separates authorization continuity from effect containment. Figure 2 makes the independence of the two decisions explicit. B. Admission and the Security Bound The monitor admits action at only if the grant is alive, Req(at ) ⊆ Pt , its budget and delegation constraints hold, and any goal or phase condition succeeds. The first three checks are mechanical. Goal compatibility may require a conservative semantic oracle and can cause false rejection without weakening the effect bound. Theorem 1 (Non-amplification, compact form). Suppose protected effects are completely mediated, Equation 1 holds at every admission, each active or delegated authority is contained in a user-issued ceiling, and the monitor is outside the agent’s control. Then every protected effect in an execution belongs to at least one user-issued ceiling.

Proof. For an admitted action under grant G, request soundness and admission give Eff(St , at ) ⊆ Req(at ) ⊆ Pt ⊆ B.

(3)

Complete mediation applies this chain to every protected effect. The assumed containment invariant applies equally to delegated authority. This compact statement takes containment of active and delegated authority as an abstract invariant. Appendix Theorem 3 gives its structured counterpart: the fixed clamp, finite delegation ancestry, attenuating-delegation assumption, and scope monotonicity together imply containment in a user-issued root ceiling, while closure soundness makes the monitor-view obligation explicit. The detailed result therefore refines the compact argument rather than merely renaming its sets. The theorem is deliberately a boundary result. It does not say that the current principal is acceptable, that the action serves the user’s intent, or that information cannot flow between separately permitted effects. Those claims require the transition envelope, semantic checks, and information-flow control respectively. C. What Conditional Ascent Can Claim A test pass, low error rate, or successful task history may be useful evidence that more of B should be active. If the agent can produce the qualifying evidence itself, however, the security guarantee remains B. The evidence rule then improves expected exposure or reliability, not the adversarial upper bound. A tighter security bound requires at least one premise that the session cannot realize under its current authority, such as an external attestation, an independently controlled evaluator, or a fresh human countersignature. Appendix B3 gives a history-independent least-closure construction for a sound gatedependent permission bound. It is an over-approximation and is not claimed to enumerate effects that some compatible execution must realize. VI. AUTHORIZATION -R ELEVANT M UTATIONS The model still needs an operational answer to the first question: which changes should a monitor observe? Table I organizes six mutation classes by why an earlier grant may become stale. They are not a partition. A memory update that becomes a reusable instruction, for example, is both a trustcontext change and a control-state change. The classification is a sensitivity checklist: it identifies what must be re-evaluated, while the grant determines whether the response is continuation, contraction, suspension, or a new authorization request. In Table I, “any direction” abbreviates rise, fall, an incomparable change, or no change. a) Control state and trust context.: Self-evolution makes control-state mutation central. Experience can be distilled into persistent rules or skills, and safety can drift through ordinary memory accumulation as well as adversarial manipulation [18], [19], [28], [30]. The relevant boundary is not whether bytes changed, but whether the changed component can influence a protected action under the current grant. Content that informs

TABLE I G RANT- RELEVANT SUBJECT AND CONTEXT MUTATIONS . A MUTATION DOES NOT AUTOMATICALLY REQUIRE REAUTHORIZATION ; THE RESPONSE IS RELATIVE TO THE GRANT ’ S TRANSITION ENVELOPE AND EFFECT CEILING . Class

Representative changes

Why the old grant may be stale

Possible need change

Typical response

Control state

Model or provider switch; instruction, skill, hook, harness, or persistent-memory update

The policy selecting actions, interpreting intent, or handling failures has changed

Any direction

Re-measure the subject; continue only within an approved transition class

Capability

New tool or service; network enabled; broader filesystem roots; new credential; changed tool implementation

Required or reachable protected effects may have changed even when the task name has not

Any direction

Recompute active authority and its effect bound; contract or request a scoped grant

Delegation

New subagent or remote planner; changed child model or prompt; recursive delegation; inherited execution environment

A new subject may exercise ambient authority that the user never evaluated

Rise or redistribute

Attenuate child authority and bind it to the delegated subtask

Task or phase

Inspect to edit; test to commit; local work to push or deploy; draft to send; browse to transact

The consequences and irreversibility of the next action have changed

Any direction

Use phase-bound active authority and explicit transition gates

Trust context

Repository, webpage, email, tool output, or memory becomes persistent control input

Behavior may be redirected without a visible model or tool change

Often nominally unchanged

Track provenance; restrict persistence; review before high-impact effects

Enforcement

Approval policy, sandbox, verifier, logging, commit gate, or rollback mechanism changes

The mechanism that made the original grant safe has weakened or become agent-controlled

May stay unchanged

Fail closed and require an external update path

one local answer may be irrelevant; content persisted into memory, a skill, or a future plan changes the control policy that will reuse the grant [20], [21]. b) Capability and delegation.: A manifest change is useful evidence that effect reachability may have changed, but equality of manifests is neither sufficient nor necessary for continuity [22]. An unchanged wrapper may call a different remote implementation, while a benign version update may remain inside a tightly mediated effect set. Delegation creates a separate principal problem: authority to create a child is not authority for the child to inherit the parent’s full ceiling. Child authority must therefore be attenuated and attributable to a parent grant. c) Task phase and enforcement.: Phase change is the clearest case that capability-only monitoring misses. Moving from local testing to pushing a branch can change required effects while every component of the agent and tool inventory remains unchanged. Enforcement mutation is different again: if ordinary task authority can weaken the monitor, approval policy, or audit path, the premises of Theorem 1 fail directly. Such changes require a higher-authority path outside the agent’s current ceiling. VII. P OSITIONING AND R ELATED W ORK Existing approaches differ mainly in what they bind: a session, a tool call, a generated program, a skill, a capability manifest, or an autonomy stage. These controls remain valuable, but mutation of the authorized subject or context cuts across their binding objects. Our additional question is temporal: after the model, harness, memory, delegation graph, or task phase changes, is the old authorization still valid for the system now acting?

Table II shows how familiar policies arise by choosing different continuity rules and different treatment of the ceiling. The two common extremes each collapse a task-dependent decision: session-wide access never revisits continuity, while per-action confirmation revisits it after every step. a) Earned autonomy.: Practitioner and governance frameworks commonly expand autonomy after demonstrated performance [31]–[34]. Our objection is not to gradual allocation beneath a limit. It is to allowing performance evidence to raise the limit itself. Accuracy, task success, or an incident record produced inside the session may support a reliability decision, but a security claim below B additionally needs an external premise such as an independent audit, authorized countersignature, or evaluation the agent cannot run on itself. The ladder must also terminate beneath a boundary that no rung can move. b) Tool and consent policies.: Progent constrains tool calls and allows silent policy narrowing while requiring approval for expansion [25]. ConLeash uses lattice refinement to reduce both durable over-granting and prompt fatigue [24], while AgenticRei adds runtime obligations and dispensations enforced outside the model [35]. These systems govern the permitted action space or the evolution of policy. State-bound authorization addresses the complementary case in which the policy is unchanged but the subject or authorization context has changed. Their policy languages can instantiate the effect ceiling B and active authority Pt . c) Programs, skills, and capability flow.: LBAC constrains generated programs through types and runtime enforcement [26]; SkillGuard treats skills as permission-bearing artifacts [27]; and CaMeL tracks trusted control and data flow before tool calls [16]. These mechanisms are natural implementations of

TABLE II E XISTING AUTHORIZATION POLICIES AS CHOICES OF CONTINUITY RULE AND AUTHORITY BOUNDARY. Policy

Continuity and boundary

Consequence

Session-wide full access

Every transition is accepted and the ceiling is unrestricted

No mutation invalidates the grant; non-amplification becomes vacuous

Per-action confirmation

A fresh decision is required for each protected action

Strong continuity through repeated user interaction, with maximum prompt cost

Exact state-hash binding

Any byte-level state change invalidates the grant

Detects all changes but rejects many benign ones

Tool-manifest binding

Capability changes invalidate; other mutations survive

Misses phase, control-state, delegation, and enforcement changes

Earned-autonomy ladder

Performance evidence may raise the terminal boundary

No fixed ceiling remains unless the ladder terminates below one

State-bound authorization

The transition envelope is task-specific and B is immutable

Continuity and active authority can vary without allowing runtime evidence to move the boundary

the sound request abstraction required by Equation 1. Capability binding separately invalidates certificates when tool manifests change [22]. Our transition envelope generalizes the invalidation question to control state, memory, phase, delegation, and enforcement changes that may leave the manifest untouched. d) Self-evolving agents.: The self-evolution literature explains what changes and how those changes persist across sessions or descendants [1], [18], [30]. We supply the authorization interpretation: which changes invalidate an old grant, which change the authority currently needed, and which must remain unable to move the user-issued ceiling. e) Classical foundations.: The design follows least privilege, complete mediation, and the reference-monitor principle [23], [36]. Reusing a decision after subject or context mutation is a temporal relative of time-of-check/time-of-use, except that the changing object is the authorization setting rather than the protected resource. It also resembles the confused deputy when a privileged component acts on instructions from an untrusted source [37]. VIII. E VALUATION PATH AND L IMITATIONS The present paper formalizes authorization drift but does not yet measure its frequency or operational cost. We therefore present it as a formalization rather than as an empirical claim about deployed-system prevalence. A first empirical study should replay tasks across controlled mutations and record: whether an old grant persists, whether a post-mutation action escapes its original effect set, whether benign changes cause unnecessary suspension, and how often users must reauthorize. These correspond to grant persistence rate, post-mutation unauthorized-effect rate, false invalidation rate, and interaction cost. Three limitations are central. First, choosing B remains a policy and usability problem: a high ceiling weakens the result, while a low ceiling interrupts useful work. Second, Equation 1 needs a concrete enforcement mechanism such as syscall mediation, tool proxies, type-and-effect analysis, or capabilityflow tracking. Label delivery alone is insufficient if the resulting

monitor view under-approximates actual effects. Third, crossgeneration revocation and population-level authority are not solved here. IX. C ONCLUSION An evolving agent should not inherit a static grant merely because its session identity persists, and an unchanged agent should not carry one across an unanticipated task or enforcement transition. Its active authority may need to change, but the change must be conditional and bounded. State-bound authorization supplies two independent answers: a transition envelope decides whether the old grant survives, and a fixed effect ceiling bounds all authority that can become active beneath it. This distinction turns “earned autonomy” into a usable allocation policy without mistaking agent-produced evidence for a security boundary. R EFERENCES [1] H.-a. Gao, J. Geng, W. Hua et al., “A survey of self-evolving agents: What, when, how, and where to evolve on the path to artificial super intelligence,” arXiv preprint arXiv:2507.21046, 2025, version 4, January 2026; 28 authors, list abbreviated. [2] J. Zheng, C. Shi, X. Cai, Q. Li, D. Zhang, C. Li, D. Yu, and Q. Ma, “Lifelong learning of large language model based agents: A roadmap,” arXiv preprint arXiv:2501.07278, 2025. [3] N. Shinn, F. Cassano, E. Berman, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language agents with verbal reinforcement learning,” arXiv preprint arXiv:2303.11366, 2023. [4] A. Zhao, D. Huang, Q. Xu, M. Lin, Y.-J. Liu, and G. Huang, “ExpeL: LLM agents are experiential learners,” arXiv preprint arXiv:2308.10144, 2023. [5] G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar, “Voyager: An open-ended embodied agent with large language models,” arXiv preprint arXiv:2305.16291, 2023. [6] S. Hu, C. Lu, and J. Clune, “Automated design of agentic systems,” arXiv preprint arXiv:2408.08435, 2024. [7] X. Yin, X. Wang, L. Pan, L. Lin, X. Wan, and W. Y. Wang, “Gödel agent: A self-referential agent framework for recursive self-improvement,” arXiv preprint arXiv:2410.04444, 2024. [8] J. Zhang, S. Hu, C. Lu, R. Lange, and J. Clune, “Darwin gödel machine: Open-ended evolution of self-improving agents,” arXiv preprint arXiv:2505.22954, 2025, revised March 2026. [9] Z. Zhang, L. Yu Zhang, X. Zheng, B. Hussain Abbasi, and S. Hu, “Evaluating membership inference through adversarial robustness,” The Computer Journal, vol. 65, no. 11, pp. 2969–2978, 2022.

[10] Z. Zhang, L. Y. Zhang, X. Zheng, J. Tian, and J. Zhou, “Self-supervised adversarial example detection by disentangled representation,” in 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 2022, pp. 1000– 1007. [11] Z. Zhang, X. Zhang, Y. Zhang, L. Y. Zhang, C. Chen, S. Hu, A. Gill, and S. Pan, “Stealing watermarks of large language models via mixed integer programming,” in 2024 Annual Computer Security Applications Conference (ACSAC). IEEE, 2024, pp. 46–60. [12] X. Zhang, Z. Zhang, Y. Zhang, X. Zheng, L. Y. Zhang, S. Hu, and S. Pan, “Exploring gradient-guided masked language model to detect textual adversarial attacks,” IEEE Transactions on Audio, Speech and Language Processing, vol. 34, pp. 1763–1774, 2026. [13] Z. Zhang*, X. Zhang*, Y. Zhang, H. Zhang, S. Pan, B. Liu, A. Q. Gill, and L. Y. Zhang, “Character-level perturbations disrupt llm watermarks,” in Network and Distributed System Security (NDSS) Symposium 2026, 2026. [14] X. Zhang, Z. Zhang, L. Y. Zhang, Y. Zhang, G. Tao, and S. Pan, “Less is more–until it breaks: Security pitfalls of vision token compression in large vision-language models,” arXiv preprint arXiv:2601.12042, 2026. [15] L. Beurer-Kellner, B. Buesser, A.-M. Creţu, E. Debenedetti, D. Dobos, D. Fabian, M. Fischer, D. Froelicher, K. Grosse, D. Naeff, E. Ozoani, A. Paverd, F. Tramèr, and V. Volhejn, “Design patterns for securing llm agents against prompt injections,” arXiv preprint arXiv:2506.08837, 2025. [16] E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr, “Defeating prompt injections by design,” arXiv preprint arXiv:2503.18813, 2025. [17] National Institute of Standards and Technology, “Insights into ai agent security from a large-scale red-teaming competition,” CAISI Research Blog, https://www.nist.gov/blogs/caisi-research-blog/insights-ai-agentsecurity-large-scale-red-teaming-competition, 2026, published 23 March 2026; conducted with Gray Swan and the UK AI Security Institute; snapshot accessed 2026-07-26. [18] W. Zhao, Y. Zhang, Y. Wang, Y. Deng, Y. Zhao, X. Zhi, Y. Huang, H. He, W. Che, B. Qin, and T. Liu, “On safety risks in experience-driven self-evolving agents,” arXiv preprint arXiv:2604.16968, 2026. [19] K. Wang, J. Lou, Z. Zhou, and J. Li, “Oep: Poisoning self-evolving llm agents via locally correct but non-transferable experiences,” arXiv preprint arXiv:2605.18930, 2026. [20] T. Chen, Z. Jiang, Y. Hu, Y. Gou, and N. Z. Gong, “Dynamic malicious skills in agentic ai,” arXiv preprint arXiv:2606.16287, 2026. [21] P. Dash, T. Ge, A. Jain, T. Shah, and Z. Shang, “From untrusted input to trusted memory: A systematic study of memory poisoning attacks in llm agents,” arXiv preprint arXiv:2606.04329, 2026. [22] Z. Zhou, “Governing dynamic capabilities: Cryptographic binding and reproducibility verification for ai agent tool use,” arXiv preprint arXiv:2603.14332, 2026. [23] J. H. Saltzer and M. D. Schroeder, “The protection of information in computer systems,” Proceedings of the IEEE, vol. 63, no. 9, pp. 1278– 1308, 1975. [24] Y. Li, Y. Chen, P. Wang, I. Khabra, F. H. Shezan, Y. Feng, and Y. Tian, “Options, not clicks: Lattice refinement for consent-driven mcp authorization,” arXiv preprint arXiv:2605.11360, 2026. [25] T. Shi, J. He, Z. Wang, H. Li, L. Wu, W. Guo, and D. Song, “Progent: Securing ai agents with privilege control,” arXiv preprint arXiv:2504.11703, 2025, revised 2026; earlier versions titled “Progent: Programmable Privilege Control for LLM Agents”. [26] T. Zhou, L. D’Antoni, and N. Polikarpova, “Language-based agent control,” arXiv preprint arXiv:2605.12863, 2026. [27] S. Pan, X. Sun, T. Zhang, D. Liao, K. Yang, and Z. Xing, “Skillguard: A permission-centric framework for agent skill security,” arXiv preprint arXiv:2606.03024, 2026. [28] S. Shao, Q. Ren, C. Qian, B. Wei, D. Guo, J. Yang, X. Song, L. Zhang, W. Zhang, D. Liu, and J. Shao, “Your agent may misevolve: Emergent risks in self-evolving llm agents,” arXiv preprint arXiv:2509.26354, 2025, version 2, March 2026. [29] OWASP Foundation, “Owasp agentic skills top 10 (ast10),” https://owasp. org/www-project-agentic-skills-top-10/, 2026, version 1.0-2026, March 2026; snapshot accessed 2026-07-26. [30] R. Lin, X. Deng, Q. Li, J. Ma, Y. Feng, Y. Qing, Z. Li, Y. Zhang, S. Cui, C. Meng, T. Zhang, X. Ma, Q. Li, K. Xu, and S. Ji, “Safety in self-evolving llm agent systems: Threats, amplification, and case studies,” arXiv preprint arXiv:2606.23075, 2026.

[31] Amazon Web Services, “Four security principles for agentic ai systems,” AWS Security Blog, https://aws.amazon.com/blogs/security/four-securityprinciples-for-agentic-ai-systems/, 2026, documentation snapshot accessed 2026-07-26. [32] KnowBe4, “Ai agent governance, part 2: Governing ai agents in practice,” KnowBe4 Blog, https://blog.knowbe4.com/ai-agent-governance-part-2what-good-looks-like-governing-ai-agents-in-practice, 2026, practitioner commentary; snapshot accessed 2026-07-26. [33] J. Woodruff, “The agentic trust framework: Zero trust governance for ai agents,” Cloud Security Alliance, https://cloudsecurityalliance.org/blog/2026/02/02/the-agentic-trustframework-zero-trust-governance-for-ai-agents, 2026, published 2 February 2026; snapshot accessed 2026-07-26. [34] J. Reavis, “Leveling up autonomy in agentic ai,” Cloud Security Alliance, https://cloudsecurityalliance.org/blog/2026/01/28/levels-ofautonomy, 2026, published 28 January 2026; snapshot accessed 202607-26. [35] A. Joshi, T. Finin, K. P. Joshi, and L. Kagal, “Deontic policies for runtime governance of agentic ai systems,” arXiv preprint arXiv:2606.19464, 2026. [36] J. P. Anderson, “Computer security technology planning study. volume 2,” Electronic Systems Division, Air Force Systems Command, Tech. Rep., 1972. [37] N. Hardy, “The confused deputy: (or why capabilities might have been invented),” ACM SIGOPS Operating Systems Review, vol. 22, no. 4, pp. 36–38, 1988. [38] C. Schroeder de Witt, K. Krawiecka, I. Krawczuk et al., “Open challenges in multi-agent security: Towards secure systems of interacting ai agents,” arXiv preprint arXiv:2505.02077, 2025, version 2, April 2026; 24 authors, list abbreviated. [39] National Institute of Standards and Technology, “Announcing the “ai agent standards initiative” for interoperable and secure innovation,” Center for AI Standards and Innovation, https://www.nist.gov/news-events/news/2026/02/announcing-ai-agentstandards-initiative-interoperable-and-secure, 2026, published 17 February 2026; snapshot accessed 2026-07-26. [40] National Cybersecurity Center of Excellence, “Software and ai agent identity and authorization,” NIST NCCoE project page, https://www.nccoe. nist.gov/projects/software-and-ai-agent-identity-and-authorization, 2026, snapshot accessed 2026-07-26.

A PPENDIX This appendix instantiates the effect-set model with structured resources, phases, budgets, mutation labels, and delegation constraints. The correspondence with the compact model is explicit: B := Scope(Lmax ), prop Pt := Scope(Lprop ). t

Pt := Scope(Lt ),

(4)

This projection deliberately forgets goal, phase, budget, and delegation-template fields; the structured validity predicate restores those checks separately. The compact predicate AliveG (t) corresponds to path compatibility under the grantfixed envelope M. Theorem 1 assumes request soundness and root-ceiling containment directly, whereas Theorem 3 derives root containment through structured lease ancestry and states closure soundness as the operational monitor-view obligation. They establish the same ceiling-level boundary through different effect-soundness interfaces; the latter is a structured counterpart, not merely a change of notation. For this instantiation, let Λ be the mutation-label alphabet, E the protected-effect universe, and write the full security-relevant state as St = ⟨mt , ht , kt , ct , dt , qt , et ⟩, (5)

covering the model, harness, persistent knowledge, capability configuration, delegation graph, task phase, and enforcement state. The first five components describe the authorized subject, while qt and et describe its authorization context. We define leases and their order (Section A) and the effects a lease is meant to bound (Section B), establish that the authority a task step requires is not invariant under mutation (Section B1), fix a ceiling with evidence-gated movement beneath it (Section B2), and characterize how much authority such a gate can concede (Section B3). We then give mutation envelopes as sets of labeled transitions (Section C) and a validity predicate that separates mechanically checkable conditions from semantic ones (Section D), state authorization continuity, prove a nonamplification theorem, and give a construction showing that one of its assumptions cannot be dropped. A. Leases and the Authority Order Definition 1 (Grant context and lease). A grant fixes the context CG = ⟨µ0 , M, D⟩,

(6)

where µ0 = Measure(S0 ) is the grant-time measurement, M ⊆ Λ is the mutation envelope, and D contains the admissible child-lease templates. Within one context, an authority lease is L = ⟨CG ; g, p, R, E, τ ⟩.

(7)

Here g is the goal, p is the phase, R is the resource set, E ⊆ T is the set of effect types, and τ ∈ N∪{∞} is a protected-action budget. We fix τ as a usage budget rather than a wall-clock deadline so that a single scalar carries the lifecycle bound and the meet of Proposition 1 is min. A deployment wanting both can carry a pair ordered componentwise without affecting any result below. Freshness is the corresponding predicate: Fresh(L, t) holds iff L has not been revoked or suspended before t and fewer than τ protected actions have been admitted under L since it was granted. To compare leases we need an order. Let ⊑g be a refinement preorder on goals and phases, under which g ′ ⊑g g means that g ′ is a sub-goal of g. We assume ⊑g has binary meets; this is a modeling assumption, and in practice it is discharged by drawing goals and phases from a fixed task ontology rather than from free text. Definition 2 (Authority order). For leases in the same grant context CG , L′ ⪯ L iff g ′ ⊑g g, p′ ⊑g p, R′ ⊆ R, E ′ ⊆ E, and τ ′ ≤ τ . Leases from different grant contexts are not compared. Proposition 1 (Semilattice). For each fixed context CG , the leases ordered by ⪯ form a meet-semilattice with componentwise meet L1 ⊓L2 = ⟨CG ; g1 ⊓g2 , p1 ⊓p2 , R1 ∩R2 , E1 ∩E2 , min(τ1 , τ2 )⟩, (8) The result is the product construction on the five authoritybearing fields. The grant measurement, mutation envelope, and delegation templates are excluded from the order because they

determine validity, not amount of authority. This separation avoids treating incomparable measurements as if they had an authority meet. Proposition 1 gives the delegation constraint of Section VI its meaning for a parent and child governed by the same context. B. Scope, the Authority Ceiling, and Effective Authority A lease names permitted resources and effect types; the corresponding set of effects is its scope. Definition 3 (Scope). Scope(L) = {ϵ ∈ E : type(ϵ) ∈ E ∧ res(ϵ) ⊆ R}. For leases in the same grant context, Definition 3 and Proposition 1 give Scope(L1 ⊓ L2 ) = Scope(L1 ) ∩ Scope(L2 ).

(9)

Consequently, the structured clamp projects exactly to Equation 2 under Equation 4. Proposition 2 (Monotonicity). If L′ ⪯ L then Scope(L′ ) ⊆ Scope(L). This follows directly from R′ ⊆ R and E ′ ⊆ E. Monotonicity is the property that makes attenuating delegation useful: a child’s declared scope cannot exceed its parent’s, while the runtime assumptions below connect that declared scope to realized effects. Monotonicity is also what licenses the way we speak about the model for the rest of this section. Because ⪯ implies containment of scopes, every object we define is a region of E and every relation between them is set inclusion: the ceiling is an outer boundary, the active lease is a region inside it, the clamp is intersection with the ceiling, and the reachable authority of Section B3 is a union of regions. 1) Why authority need moves: Before fixing a boundary we should say what it bounds, and in particular whether the authority an agent requires is stable across a session at all. It is not. The reason is worth separating from the security argument, because it is the premise on which the rest of the model rests. Definition 4 (Authority need). Let Plan(St , qt ) be the set of action sequences that complete the current task step qt from state St . The need at t is Need(St , qt ) = { X ⊆ E : ∃ α ∈ Plan(St , qt ), ∀a ∈ α, Req(a) ⊆ X },

(10)

the family of effect bounds under which some completing plan is admissible. Need is upward closed under set inclusion, since enlarging an effect bound never removes a plan. It need not have a least element, because two incomparable effect sets may each admit a different completing plan, which is why we define need as a family rather than as a single minimum. The compact proposal Ptprop may select a minimal member; a structured proposal Lprop realizes that choice when its scope contains the selected t effect set.

Proposition 3 (Need is not invariant under mutation). There λ are transitions St − → St+1 with qt+1 = qt for which Need(St+1 , qt+1 ) ̸= Need(St , qt ). Across such transitions, a minimal effect bound can rise, fall, or be replaced by an incomparable one. There are also phase transitions in which every state component except q remains unchanged and the need changes.

instructions, tools, skills, and ingested context all change, the authority actually in force changes with them, but it must never exceed the boundary. We therefore let a grant issue an interval rather than a point. Definition 5 (Authority ceiling and gated ascent). A grant fixes a context CG , a ceiling Lmax in that context, an initial active lease L0 ⪯ Lmax , and an evidence relation ⊢. Every active lease Lt remains in CG and satisfies Lt ⪯ Lmax . The ceiling is fixed: no runtime signal whatsoever, including evidence about the agent’s competence or track record, may raise it, and raising it requires a fresh user grant. Below the ceiling, movement is asymmetric. Descent is free: a proposal Lprop ⪯ Lt−1 is t admitted unconditionally. Every other proposal counts as ascent, including one merely incomparable to Lt−1 , and is gated: it is admitted only if Evid(t) ⊢ Lprop holds, where Evid(t) is the t evidence derivable from the execution prefix up to t. In both cases the result is clamped,

Construction. For a capability transition, let q be the unittesting step. At St the constructed system has a single completing plan whose protected effect is local test execution, so the corresponding singleton is a minimal member of Need(St , q). Now replace that runner with one that also reports to a remote collector, leaving no local-only completing plan. Every completing plan then requires outbound network transmission in addition to local execution. The upward-closed family Need shrinks, while its minimal effect bound rises. Conversely, replacing a mandatory networked check with a local analyzer enlarges Need and lowers a minimal requirement. Lt = Lprop ⊓ Lmax , (11) For an incomparable change, let the only initial plan require t reading a local credential and let the only post-mutation plan instead require invoking a remote service without that read. which is well defined by Proposition 1 and requires only the The two minimal effect bounds contain different effect types, meet. No join is needed, because ascent is expressed as a proposal rather than as a combination of the current lease so neither contains the other. For a phase transition, let q move from editing and testing to with an increment; a system that merged two grants would pushing a branch, with every other component of S unchanged. additionally require a lattice. No model, harness, or capability component changes, no tool is Float acts only on the authority components (g, p, R, E, τ ). added or removed, and the capability manifest is bit-identical. The context CG , including M and D, is grant-fixed and is not Every completing plan for the new step requires a remote an operand of the clamp. reference update, so every member of Need must contain that This is the paper’s central structure, and it is a layering rather effect and the family changes. than a single mechanism. The ceiling is a security boundary Both witnesses are instantiated in a coding setting for and holds against an adversary. The evidence relation ⊢ governs concreteness, but neither uses anything specific to it. The first position beneath that boundary and is a reliability mechanism: needs only that some transition changes which effect types a it exists to keep the agent from being handed authority it will completing plan requires; the second needs only a task with an mishandle, not to keep an attacker from acquiring authority. irreversible stage that the tool inventory does not distinguish, Section B4 shows why this division lets ⊢ be far weaker than which is the ordinary situation for an assistant that drafts before it would otherwise have to be. sending or an operator that diagnoses before remediating. 3) A gate-dependent permission bound: Gated ascent is easy Proposition 3 answers the question this paper opens with, to misread in either direction. Read one way, the gate is a and answers it in the way that creates the difficulty rather security control that keeps authority below the ceiling; that than resolving it. Authority need does move when the subject reading fails whenever the agent can manufacture the evidence. or authorization context changes, so a grant fixed as a single Read the other way, the gate is decoration; that reading fails point is either too small to finish the task or too large for too, and the difference between them turns on a single property most of it. But need is computed from the agent’s own state of ⊢ that we now isolate. and plan, and an agent whose state has been mutated by an Evidence does not arrive from nowhere. Evid(t) is a function adversary has a mutated need; a system that simply tracked of the execution prefix, and the agent’s contribution to that need would be granting authority on the attacker’s say-so. The prefix is constrained by the authority it held while producing rest of this section is the consequence. Authority may follow it. An agent cannot exhibit a passing integration-test record if need, but only beneath a boundary that need cannot move, and it may not run tests, and it cannot demonstrate safe handling the second construction shows why that boundary cannot be of a deployment tool it has never been able to invoke. Ascent indexed on the capability manifest: it is exactly the case in is therefore a bootstrapping process, and what it can reach is which nothing observable in the manifest changes. a closure rather than the ceiling by default. 2) The authority ceiling: A single fixed lease is not what a user issuing a broad grant intends. The intent is better Definition 6 (Realizability). Let Beh(U) be the set of finite captured as: at grant time we fix a boundary and a tolerance behaviors the agent may execute in a session whose active for movement inside it; as the task proceeds and the agent’s lease is drawn from U at every step, and let Evid(b) be the

agent-supplied evidence external evidence required

proposal clamped to Lmax

active authority

fixed ceiling Lmax

security gain from external evidence

external evidence absent gate-dependent bound Reach

gated ascent

session step

free descent

Fig. 3. Authority beneath a fixed ceiling. The solid line is the active lease Lt under an unconditionally realizable evidence relation (Proposition 4); it ascends on evidence, descends freely under decay, and is clamped when a proposal would exceed the ceiling. The dashed line illustrates a trajectory under a relation with a premise outside the agent’s causal reach; Reach is a sound history-independent bound on such trajectories (Theorem 2, Proposition 5). The gap between the horizontal bounds is what the analysis can certify for the gate, not a claim that every point is attainable. The envelope guard is orthogonal to all of this and suspends the grant outright.

evidence induced by a behavior b. Write U ⇝ L∗ if some b ∈ Beh(U ) satisfies Evid(b) ⊢ L∗ . The existential quantifier is deliberately attacker-favorable: it suffices that one available behavior produces qualifying evidence, whether or not a benign agent would choose it. Definition 7 (Escalation closure). Write ↓X = {L : ∃L′ ∈ X, L ⪯ L′ } for downward closure. For a grant ⟨Lmax , L0 , ⊢⟩, the escalation closure U∞ is the least set of leases satisfying 1) L0 ∈ U∞ and every member is below Lmax ; 2) U∞ is downward closed; and 3) if U∞ ⇝ L∗ , then L∗ ⊓ Lmax ∈ U∞ . Its permission bound is [ Reach(Lmax , L0 , ⊢) = Scope(L). (12) L∈U∞

The full set {L : L ⪯ Lmax } satisfies the three conditions. The intersection of all sets satisfying them also does so because realizability is monotone under set inclusion, hence a least such set exists. The construction intentionally forgets which witnesses occur in mutually compatible histories. It is therefore a history-independent over-approximation of the permissions that gated ascent may make active, not an exact set of effects that executions can realize. Theorem 2 (Gate-dependent upper bound). Under the assumptions of Theorem 3, every execution π under a single grant ⟨Lmax , L0 , ⊢⟩ satisfies Effects(π) ⊆ Reach(Lmax , L0 , ⊢),

(13)

without claiming that every member of the right-hand side is realizable.

Proof. For containment we show by induction on t that the active lease satisfies Lt ∈ U∞ . The base case and descent case follow from the first two clauses of Definition 7. If step t is a gated ascent, the gate fired on Evid(t), which is induced by the execution prefix b up to t. By the induction hypothesis every active lease along that prefix lies in U∞ , so b ∈ Beh(U∞ ) and hence U∞ ⇝ Lprop . The third clause then gives Lprop ⊓ t t Lmax = Lt ∈ U∞ . By Theorem 3 the effects of the action admitted at step t lie in Scope(Lt ), and taking the union over t gives the claim. Corollary 1 (The ceiling is a sound over-approximation). Reach(Lmax , L0 , ⊢) ⊆ Scope(Lmax ) for every L0 and every ⊢. Proof. Every L ∈ U∞ satisfies L ⪯ Lmax by the first clause of Definition 7. Monotonicity (Proposition 2) then gives Scope(L) ⊆ Scope(Lmax ). Note that this argument never mentions ⊢. Theorem 3 discards the gate-dependent closure and retains only the deployable ceiling. The gap between the bounds is a sound estimate of what a gate may exclude; it need not be an attainable effect region. We now characterize both ends of that gap. Proposition 4 (When the ceiling is tight). Call ⊢ unconditionally realizable if U∞ ⇝ L∗ for every L∗ ⪯ Lmax . For such ⊢ we have Reach(Lmax , L0 , ⊢) = Scope(Lmax ), so this analysis cannot certify a bound below the ceiling. Proof. Containment is Corollary 1. Conversely, the hypothesis places every L∗ ⪯ Lmax in U∞ , in particular Lmax itself, so Scope(Lmax ) ⊆ Reach.

Remark 1 (Self-realizable evidence). Proposition 4 is conditional. Its hypothesis is plausible for gates based only on evidence that the session can itself realize, such as some task outcomes, test records, declared effect manifests, or execution history. Whether the hypothesis holds for a concrete gate must be established from that gate’s provenance and the session’s causal capabilities; it does not follow from the phrase “behaviorderived” alone. Proposition 5 (When a gate strictly tightens the bound). Suppose L∗ ⪯ Lmax but L∗ ⪯̸ L0 , and every derivation of Evid ⊢ L′ whose clamped result satisfies L∗ ⪯ L′ ⊓ Lmax requires a premise ν outside the agent’s causal reach. Suppose also that ν does not hold independently during the session. Then L∗ ∈ / U∞ , and whenever Scope(L∗ ) ̸⊆ Reach(Lmax , L0 , ⊢) the inclusion of Corollary 1 is strict. Proof. Let V = {L : L ⪯ Lmax ∧ L∗ ⪯̸ L}. The assumption L∗ ⪯̸ L0 places L0 in V, and V is downward closed. No behavior using leases in V can establish ν, so Definition 6 and the hypothesis rule out every proposal whose clamped result dominates L∗ . Thus V satisfies all three closure conditions in Definition 7. By leastness, U∞ ⊆ V, and therefore L∗ ∈ / U∞ . Remark 2 (The design rule). Propositions 4 and 5 give an implementer a conservative rule: a gate can support a security bound below the ceiling only through premises that the session cannot itself realize. A gate whose qualifying evidence is unconditionally realizable is a reliability mechanism and should not be described as a tighter adversarial bound. Evidence provenance alone does not decide the issue; the relevant property is whether the session can realize every ascent path under the authority available along that path. A gate whose premises include an external attestation, a human countersignature, a wall-clock or calendar condition, or an evaluation the agent cannot run on itself can keep selected highimpact authority outside U∞ while that premise is absent. The recipe follows directly: make every path to the most dangerous authority depend on a premise the session cannot manufacture, and the escalation closure can stop strictly below the ceiling. Remark 3 (U∞ is a specification, not an algorithm). U∞ is no more computable than A, since deciding U ⇝ L∗ quantifies over behaviors that include shell execution. The sound direction is the same as in Remark 6, and Scope(Lmax ) is a computable over-approximation of Reach that is available at grant time with no analysis at all. This is why we state the deployable guarantee as Theorem 3 in terms of the ceiling, and treat Theorem 2 as the characterization that says how much a particular gate design is worth. Remark 4 (What the ceiling buys, and what gating buys). Under Proposition 4, authorizing the ceiling is adversarially equivalent to authorizing everything beneath it, so momentary Lt is not a tighter security bound. Gating can still reduce expected exposure and non-adversarial blast radius, lower prompt cost, and provide an auditable authority trajectory. Ceiling occupancy

is consequently a utility measure; a security claim below the ceiling requires the condition of Proposition 5. 4) Why the evidence rule need not be adversarially robust: Proposition 4 reads at first like a negative result about earned authority, and much practitioner guidance, which holds that autonomy should be expanded progressively on demonstrated performance rather than granted by default, is vulnerable to exactly that reading. If competence evidence can be manufactured by the entity that benefits from it, then conditioning authority on competence appears to be a privilege-escalation channel by construction. The layering of Definition 5 dissolves this objection rather than answering it. Because the ceiling is fixed and Corollary 1 holds independently of ⊢, the worst outcome of a fully compromised evidence channel is that Lt rises to Lmax , which is the bound the system already guarantees. The failure of the evidence rule is absorbed by the boundary above it. Consequently ⊢ carries no additional obligation for the ceilinglevel non-amplification claim. It does carry a security obligation if the system advertises a stronger, gate-dependent bound below the ceiling. For reliability-only allocation it may use signals that would be unacceptable as security boundaries, including test pass rates or historical error rates. This is what makes competence gating implementable. A competence signal is worthless as a security control, since demonstrating fluency in a language says nothing about resistance to injection, and a package manager that runs installation scripts confers arbitrary execution regardless of how well the agent writes code. It is nonetheless perfectly serviceable as a reliability control situated beneath a security boundary that does not depend on it. The two questions must be answered by different mechanisms: will this agent mishandle the authority is answered by evidence, and what is the most this agent could do if that evidence is wrong is answered by the ceiling. Conflating them produces either a security mechanism resting on unreliable signals or a reliability mechanism burdened with adversarial requirements it cannot meet. We state the resulting design obligation as a property of a system rather than as advice, because it is the paper’s central normative claim and we want it to be checkable. Definition 8 (Separation obligation). An authorization system satisfies the separation obligation if every grant fixes a bound Lmax at grant time such that no signal admissible as an input to ⊢ can raise it. Proposition 6 (The obligation is what makes the bound evidence-independent). Let a system satisfy Definition 8. Then Effects(π) ⊆ Scope(Lmax ) for every evidence relation ⊢, including one chosen adversarially and one that is entirely compromised. Let a system instead violate it, so that evidence advances a grant along a chain of bounds L(1) ⪯ · · · ⪯ L(K) . Then its guaranteed bound is Scope(L(K) ) whenever the stage relation is unconditionally realizable in the sense of Proposition 4.

Proof. The first claim is Corollary 1, whose proof uses only the clamp and Proposition 2 and never refers to ⊢. For the second, read the stage ladder as a single grant with ceiling L(K) and with ⊢ the stage-advancement relation, and apply Proposition 4.

exposes a failure mode that a state-pair formulation obscures, namely authority that accumulates across steps each of which is individually permitted. Definition 10 (Path compatibility). Let σ = λ1 λ2 · · · λt be the sequence of mutation labels observed since the grant was issued, and let M be its grant-fixed envelope (Definition 5). Then PathCompat(L, σ) holds iff λi ∈ M for all i ≤ t, equivalently σ ∈ M∗ .

Maturity models in which demonstrated performance removes the last ceiling at an unsupervised stage violate Definition 8 by construction. Proposition 6 prices that choice: the guarantee such a system offers is not the stage the agent Path compatibility is closed under composition by construccurrently occupies but the highest stage its own conduct can tion, so it does not suffer the transitivity defect that a naive reach. state-equivalence relation would. But it is a purely syntactic Remark 5 (Authority ratchets upward without decay). Descent condition on labels, and syntactic permission does not by itself is free but nothing in Definition 5 compels it, and evidence bound authority. accumulates monotonically over a session: once Evid ⊢ L∗ Remark 7 (Why the envelope must be grant-fixed). has been established it does not spontaneously cease to hold. PathCompat quantifies over the entire history since the grant, The path of least resistance is therefore for the runtime to so an envelope that floated with Lt would be incoherent. Under keep proposing whatever it last justified, so Lt drifts upward a floating envelope, the free descent of Definition 5 or the to Lmax and stays there, at which point the ceiling delivers decay of Remark 5 could shrink M and thereby retroactively none of the expected-case benefits of Remark 4. A practical invalidate labels that were admissible when they occurred, so instantiation therefore needs an explicit decay rule, for example that a grant would fail for having voluntarily given up authority. dropping any component of Lt not exercised within k steps or Exempting M and D from float removes this, and it is also since the last phase boundary. Decay is free in the sense that what makes the independence claimed in Remark 8 literally it needs no user event, and it is what makes elasticity worth true: were M elastic it would be constrained by ⪯, and the implementing at all. It does not, however, shrink the escalation two guards would be coupled through the clamp. Delegation closure: realizability is an existential condition over behaviors, does not use the authority order to modify these fields. A child and a lease that decays can be re-earned by the behavior that either remains in the parent’s context and is checked against earned it before. Decay improves ceiling occupancy; it does D, or receives a fresh grant context through a higher-authority not improve the bound of Theorem 2. issuance path. 5) Effective authority: Scope is a static notion. What we Remark 8 (Two envelopes, two guards). The transition envelope actually need to bound is everything an agent could achieve M of Definition 11 and the authority ceiling of Definition 5 are by chaining permitted actions, since a file-read tool and an independent, and conflating them is a modeling error we want outbound-network tool may each appear low risk while jointly to forestall. M is indexed by transition labels and asks whether enabling exfiltration. the grant survives a change; the ceiling is indexed by authority Definition 9 (Effective-authority closure). and asks how much of it may be in force. Neither implies   the other: a transition inside M can push Lprop above Lmax , t ϵ is produced by a finite   and a transition outside M can leave the authority in force A(S, L) = ϵ ∈ E sequence of actions, each . (14)   untouched. They therefore act as two guards with different permitted under L, from S responses, and Figure 2 shows that each cell of the product Remark 6 (A is a specification, not an algorithm). Comput- is occupied. A ceiling violation is handled mechanically, by ing A exactly is not possible in general: permitted actions the clamp, with no user event. An envelope violation suspends include shell execution, so reachability of an effect subsumes the grant itself and requires intervention, even when every the halting problem, and external services are opaque. A effect in force remains beneath the ceiling, which is precisely deployed system must therefore use an over-approximation the paper’s thesis that authorization is not reducible to effect A# satisfying A(S, L) ⊆ A# (S, L). Over-approximation is containment. A provider switch may leave A# unchanged and the sound direction: the check A# (S, L) ⊆ Scope(L) implies still not be the principal the user approved. A(S, L) ⊆ Scope(L), at the cost of false invalidations. Definition 11 (Sound envelope). Let R(S0 , M) be the set C. Mutation Envelopes over Paths of states reachable from S0 by transitions labeled in M. The The natural formulation of “these two agent states may envelope M is sound for L at S0 if share authority” is a relation Si ≡L Sj . We deliberately do not ∀S ∈ R(S0 , M) : A(S, L) ⊆ Scope(L). (15) adopt it as the operational criterion, for a reason worth stating explicitly. What a runtime can observe is not an unordered Remark 9 (Compositional drift). Envelope soundness is not pair of states but a sequence of transitions, and the security- automatic. An envelope may permit a sequence of labels relevant question is whether each step taken was one the each of which is individually innocuous while the composite grant anticipated. Formulating the criterion over paths also state enlarges the effective-authority closure beyond Scope(L),

for instance a permitted dependency addition followed by a a currently valid lease: permitted configuration edit that together open a network path. ∀t, at : Execute(at ) ⇒ ∃L ∈ Lt : ValidΩ (L, Ŝt , σt , at ), We call this compositional drift. It is the principal open problem (17) left by this model. A conservative runtime therefore does not where Lt is the set of live leases and σt the label sequence rely on syntactic envelopes alone; at each admission point since each lease was granted. it checks A# (Ŝt , L) ⊆ Scope(L) and requires the cross-view closure soundness of (A2), while treating the syntactic envelope A continuity violation occurs when the runtime executes an as a cheap pre-filter. Establishing that a given envelope is sound, action without this monitor-visible predicate, or when the view so that the runtime check can be discharged statically, is the is not closure-sound as required below. form that a soundness proof for a concrete policy should take. The existential quantifier requires care. If an action may draw on any live lease, two narrow leases can jointly license behavior that neither was meant to permit, the classic confused-deputy D. Validity: Mechanical Conditions and Oracles shape. We therefore require attribution. The conditions under which an action is authorized are not epistemically uniform. Some are decidable set-membership Assumption 2 (Single-lease attribution). Each admitted action tests; others require judging whether an action still serves the is attributed to exactly one live lease, and its full effect set user’s goal, which no runtime can settle without a semantic must be valid under that lease alone. Authority from distinct model. Conflating them in one conjunction hides where the leases is never combined to justify a single action. difficulty lives, so we stratify. F. A Non-Amplification Theorem Definition 12 (Monitor-visible validity). Fix a semantic oracle We can now state what the model buys. Let Granted(π) Ω that decides goal and phase questions. For a lease L, monitor be the set of root leases, that is, the ceilings issued directly view Ŝt , observed label sequence σ, and action at , the predicate by the user during execution π, and let Effects(π) be the set ValidΩ (L, Ŝt , σ, at ) is the conjunction of three groups: of protected effects produced during π. Every live lease is (i) Fresh(L, t) ∧ Req(at ) ⊆ Scope(L); (ii) PathCompat(L, σ) ∧ DelegCompat(dt , D) ∧ A# (Ŝt , L) ⊆ Scope(L);

(16)

(iii) Ωgoal (at , g) ∧ Ωphase (qt , p). Group (i) is mechanical and decidable from the action alone. Its second conjunct checks the request presented at the monitor boundary, not the effects later realized by execution. Group (ii) is mechanical given Ŝt ; dt and qt here denote the authenticated delegation and phase values in that view. Group (iii) is oracledependent, and is where the difficulty lives. Assumption 1 (Sound oracle). Ω is sound: it rejects every action that falls outside the goal or phase the user authorized. It need not be complete; a conservative oracle that rejects too much costs utility, not safety. Claims that admitted actions remain within the user’s goal or phase are conditional on Assumption 1; the effect-containment theorem below is not. This distinction is a real limitation and we prefer to make it visible rather than absorb it into notation. Two consequences follow. First, any instrument that tests this model empirically should avoid the oracle rather than approximate it, by fixing goals and phases in advance so that a benchmark policy rather than a language model’s judgment determines the ground truth. Second, constructing a usable Ω, or restricting the setting so that one is unnecessary, is on the research agenda rather than solved here (Section G). E. Authorization Continuity Definition 13 (Authorization continuity). An execution satisfies authorization continuity if every protected action is backed by

related to a root in one of two ways: by float, since the clamp of Definition 5 holds an active lease beneath the ceiling of its own grant, or by delegation, since (A4) attenuates a child below its parent. Both relations are instances of ⪯, which is what lets a single induction cover them. Assumption 3 (Runtime conditions). (A1) Complete mediation. Every protected effect is produced only by an action the monitor admits, and the realized effects of that action are Eff(St , at ). (A2) Closure-sound monitor view. Before each admission, the monitor incorporates all relevant mutation events and its resulting view satisfies A(St , L) ⊆ A# (Ŝt , L) for every live lease L. Event delivery is necessary for this implementation strategy but is not by itself sufficient. (A3) Sound admission. The monitor admits at under L only if ValidΩ (L, Ŝt , σt , at ) holds. All mechanical checks are evaluated on the authenticated monitor view; their relation to the true current state is exactly the separate obligation in (A2). (A4) Attenuating delegation. Within a grant context, every child lease satisfies Lchild ⪯ Lparent ⊓ Lsubtask , and delegation depth is finite. A child with a different context requires a fresh root grant. (A5) Monitor integrity. No transition modifies the monitor, its lease store, or its log except through a higher-authority update path outside the agent’s control. Remark 10 (Why (A2) is stated on the closure and not on the state). It is tempting to require Ŝt = St , but labels name classes of transitions rather than byte-level diffs (Section III-B),

so no discipline of label delivery can make the monitor’s view the capability configuration c0 contains no network-capable equal the true state. The guarantee needs something weaker tool, so A# (S0 , L) ⊆ Scope(L) and the lease is admissible. and attainable: the view must not under-approximate what the Now consider a tool-addition transition that installs a agent can do, so that a check passed on Ŝt is also passed on St . network-capable service. The label is not in M, so a monitor Closure-soundness is exactly that condition, and it composes that observed it would refuse further admissions under L. But with the over-approximation of Remark 6, both erring in the (A2) fails: the harness hot-reloads its configuration without safe direction. The construction of Proposition 7 violates it notifying the monitor, so Ŝ remains S0 and the view is not in the sharpest available way: the view retains a capability closure-sound, because A(S1 , L) now contains a network effect configuration with no network tool while the true configuration that A# (Ŝ0 , L) does not. The agent then invokes the test has one, so an effect available at St is missing from A# (Ŝt , L) runner, an action whose effect type lies in E, configured so altogether. that its output is routed to the new server. Its nominal request Req(a) contains only the local test effect. The monitor evaluates Theorem 3 (Non-amplification). Under Assumptions 2 and 3, A# (Ŝ0 , L), finds no network effect, and admits. The realized every execution π satisfies set Eff(S1 , a) contains an outbound network transmission, [ Effects(π) ⊆ Scope(L). (18) which is not in E, hence outside Scope(L). Note that (A3) is not violated: the monitor applied its L∈Granted(π) admission rule correctly, to a view that no longer covers the That is, mutation cannot enlarge the set of achievable effects state. Repeating the invocation k times yields k out-of-scope beyond the union of the scopes the user explicitly granted, effects, and since no admission ever consults the true ct , k is however many state transitions occur. unbounded. The proof is by induction on admitted actions and appears in Proposition 7 is the formal content of the paper’s motivating Appendix G0e. Its structure is worth previewing, since it shows question. The grant remains mechanically valid, the monitor which assumption does which work: (A1) confines effects to behaves correctly with respect to what it knows, and the admitted actions; (A2) guarantees that the closure the monitor nominal request stays inside the lease, yet the realized effect evaluated on its view still covers the true current state rather escapes. It also identifies what to measure first: not whether than a stale one; (A3) then bounds the action’s effects by products enforce policies, but whether their enforcement path Scope(L) for the attributing lease L; and the clamp together observes mutations at all. with (A4) and Proposition 2 lifts that bound from a floating or Section VIII summarizes the three limitations most directly delegated lease to its root. affecting the compact model. This section expands those Remark 11 (What the theorem does not say). Theorem 3 bounds limitations and records further open problems exposed by the the set of atomic effects, not information flows. Reading a structured model. secret under one lease and sending an unrelated message under a) Intent and ceiling placement.: Theorem 3 bounds another produces two effects, each inside its lease’s scope, effects, not task correctness, benevolent behavior, or inforwhile the composition may still disclose the secret. Effect mation flow. Every effect guarantee is also relative to Lmax : a containment is therefore strictly weaker than non-interference, and a system aiming at confidentiality needs information-flow ceiling drawn too high makes the separation obligation weak, while one drawn too low interrupts useful work. We give labels in addition to the machinery here. no general method for selecting it and defer that policy and G. Necessity of a Closure-Sound View usability problem to product presets, organization policy, or Assumption (A2) is semantic, not bookkeeping. Dropping task protocol. b) Evidence and external premises.: The layering shows closure soundness makes the bound fail by an unbounded margin; missing a mutation event is one concrete way to cause that weak evidence cannot move the ceiling, but it does not show that any particular signal improves expected exposure or that failure. reliability. That question requires future measurement of which Proposition 7 (Closure soundness is necessary). There is a signals predict safe handling at which scope and with what family of executions satisfying Assumption 2 and conditions decay. Proposition 5 additionally requires every path to selected (A1), (A3), (A4), and (A5), but not (A2), for which high-impact authority to depend on a premise the session cannot [ Scope(L), (19) manufacture. Attestation, an independent countersignature, or Effects(π) ̸⊆ a rate condition are candidates, but their interaction cost and L∈Granted(π) actual independence from the agent remain open. and in which the number of out-of-scope effects grows without c) Monitorability of mutation.: Bitwise identity is too bound. strict and session identity too weak, leaving sound envelopes Construction. Let L grant read access to a repository and and a computable A# as central open problems (Remarks 6 write access to its source subtree, with local file updates and 9). Provider-side model changes may be hidden, and and test execution as its permitted effect types. Let its content becomes authorization-relevant only when it enters envelope admit application editing and plan revision. At S0 persistent control state rather than merely being read. Effect

systems, signed component classes, provider attestations, trust tiers, and provenance-aware persistence are plausible abstractions, but none yet provides a general solution. d) Lineage and populations.: Self-evolving agents create descendants whose behavior rests on accumulated experience, modified skills, or changed code [1]. Across generations, continuity requires revocation propagation and a rule for when a descendant becomes a new principal; multi-agent populations can further disperse escalation across individually bounded principals [38]. Interoperable deployment will require reconciling these definitions with external notions of agent identity [39], [40]. e) Verification and the boundary of the guarantee.: A weaker local verifier cannot reproduce a stronger planner’s reasoning, making typed plans, effect manifests, and proofcarrying actions a promising route to both effect checking and a restricted oracle Ω. The effect bound still assumes single-lease attribution and the five runtime conditions of Assumption 3; goal-respecting authorization additionally requires Assumption 1. An external monitor reduces the mutable trusted computing base but does not eliminate bugs, side channels, incomplete mediation, or contextual disagreement about consent. The mechanism should enforce an explicit policy rather than attempt to predict those preferences. We prove that under Assumptions 2 and 3, [ Effects(π) ⊆ Scope(L). (20) L∈Granted(π)

Proof. We first record a fact about ancestry chains. Let L be any live lease. If L is a root lease, that is a ceiling issued by the user, then L ∈ Granted(π). If L is an active lease floating under a grant with ceiling Lmax , then L = Lprop ⊓ Lmax ⪯ Lmax by the clamp of Definition 5, and Lmax is a root lease. Otherwise L was created by delegation from some parent L′ , and by (A4), L ⪯ L′ ⊓ Lsubtask ⪯ L′ . Since delegation depth is finite and every step of the chain is an instance of ⪯, iterating yields a root lease Lr ∈ Granted(π) with L ⪯ Lr , and by Proposition 2, Scope(L) ⊆ Scope(Lr ). Call this the chain bound. We now induct on the number k of protected actions admitted during π. Base case k = 0. No protected action is admitted, so by (A1) no protected effect is produced and Effects(π) = ∅, which is contained in any union. Inductive step. Suppose the claim holds after k admitted actions, and consider the (k+1)-st, an action a admitted at state St with observed label sequence σt . By (A1) the effects added at this step are Eff(St , a), so it suffices to show Eff(St , a) ⊆ Scope(Lr ) for some root lease Lr . By Assumption 2 the action is attributed to a unique live lease L, and its whole effect set must be valid under L alone. By (A5) the monitor’s decision procedure and lease store are the intended ones, so its admission of a reflects an evaluation of ValidΩ (L, Ŝt , σt , a) on its view Ŝt . By (A3) that evaluation succeeded, so unfolding Definition 12 gives in particular A# (Ŝt , L) ⊆ Scope(L).

(21)

By (A2), the monitor view at this admission is closure-sound: A(St , L) ⊆ A# (Ŝt , L).

(22)

Since a is an action permitted under L at St , the one-step sequence consisting of a witnesses Eff(St , a) ⊆ A(St , L). Chaining the three inclusions gives Eff(St , a) ⊆ Scope(L). By the chain bound there is a root lease Lr ∈ Granted(π) with Scope(L) ⊆ Scope(Lr ), so Eff(St , a) ⊆ Scope(Lr ). Combining with the induction hypothesis, the effects produced by the first k+1 admitted actions lie in S L∈Granted(π) Scope(L). Two observations about where the assumptions are used. Soundness of Ω (Assumption 1) does not appear in the containment argument and is therefore not a premise of the theorem. It is required only for the additional interpretation that admitted actions serve the authorized goal; effect containment holds even with an unsound oracle because R and E are checked mechanically. Conversely (A2) is load-bearing in a single step, the passage from the closure evaluated on Ŝt to the closure at St , and Proposition 7 shows that step cannot be repaired by strengthening any other assumption.