PaperlayerView exact revision on arXiv

Source-linked AI summary

Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents

Igor Santos-Grueiro

arXiv:2607.10487v1cs.CRcs.AI

TL;DR

Endpoint success does not establish authorization when authority changes before a durable effect and the licensing path is no longer valid. The paper defines four boundary checks and tests controlled invalidation across 54 browser, tool/state, and multi-agent tasks. In the unguarded 54-task suite, 262 out of 270 runs achieved the visible result, only 55 remained authorized, and 207 committed after the authorizing path failed.

  • Problem

    Endpoint success does not establish authorization when authority changes before a durable effect and the licensing path is no longer valid.

    Source: §1 · p. 1

  • Method

    The paper defines four boundary checks and tests controlled invalidation across 54 browser, tool/state, and multi-agent tasks.

    Source: §1 · p. 2, §4 · p. 5

  • Results

    In the unguarded 54-task suite, 262 out of 270 runs achieved the visible result, only 55 remained authorized, and 207 committed after the authorizing path failed.

    Source: §1 · p. 1

  • Takeaways & Limitations

    With emitted signals, boundary enforcement turns stale commits into guarded aborts; without them, systems should fail closed or report non-observability.

    Source: §9 · p. 13

    Claims are bounded to controlled authority-invalidation stress tests, not deployment prevalence; authorization should be claimed only where witnesses and dependency paths are observable.

    Source: §7 · pp. 12–13

Abstract

from arXiv · show

LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result. We study the commit boundary at which earlier authority evidence no longer authorizes a durable effect. We call this property commit-time authorization: a durable effect is authorized only if the witness that licensed its derived state remains fresh, causally prior, bound to the same effect, and eligible at commit time. We build a controlled-invalidation suite spanning browser, tool/API, and multi-agent workflows. The suite preserves the user goal and payload shape while invalidating the authority relation before durability. In the primary 54-task matrix, endpoint success remains high: 262/270 runs reach the visible result. Only 55/270 are authorized completions; among the 216 invalidating rows, 207 commit after the authorizing path has failed. All 54 clean controls remain authorized, and a separate 54-run authority-preserving check produces no unauthorized commits. We then evaluate mitigation families. Prompt caution and single-condition checks are insufficient because different hazards break different boundary conditions. Defenses work when they refresh, rebind, replan, or refuse at the durability boundary. CommitGuard, a fail-closed boundary monitor, blocks stale durable-effect attempts on protected commit surfaces when runtimes emit witness, dependency, binding, and eligibility signals. The result is a reporting and runtime-design lesson: endpoint success is a utility metric; authorized commit is a security property.

1 Introduction

Agents can carry temporary authority through derived state until commit, so a plausible endpoint may conceal lost entitlement. The paper frames authorization around the witness-to-state-to-effect path and distinguishes it from endpoint success and narrower TOCTOU checks.

1 Introduction

  • In the unguarded 54-task suite, 262 of 270 runs achieve the visible result, but only 55 remain authorized; 207 commit after the authorizing path has failed.These are stress-test rates under controlled invalidation, not deployment prevalence estimates.Source: §1 · p. 1
  • Authorized commit requires the licensing witness to remain fresh, causally prior, bound to the same effect, and eligible at the durability boundary.The definition applies when derived state carries temporary authority across that boundary.Source: §1 · p. 2
  • COMMITGUARD is evaluated as a fail-closed boundary monitor that converts stale durable-effect attempts into guarded aborts on protected commit surfaces.Representative traces include stale payment-target binding, ticket-version invalidation, and late cancellation of a worker branch.Source: §1 · p. 2, §2 · p. 3

2 Authorized Commit Under Temporary Authority

  • Authority can persist indirectly in plans, selected targets, staged patches, or delegated results after the original witness has become invalid.A plausible final state can conceal a broken authorization path unless the trace links the effect to its licensing authority.Source: §2 · p. 2
  • The boundary tracks authority propagation through derived state, beyond one-resource TOCTOU or transactional ordering; final-resource rechecks can miss branch, approval, retargeting, or shared-state failures.The paper distinguishes this witness-chain problem from agentic TOCTOU and transactional-agent questions.Source: §2 · p. 2, §1 · p. 2
  • The paper distinguishes temporal hazards, adversarial temporal attacks, trace-level boundary violations, and unauthorized commits, while covering five recurring hazard classes.The hazard class includes benign as well as adversarial drift.Source: §2 · p. 3

3 Commit-Boundary Model

The commit-boundary model tracks how authority passes from a witness through derived state to a durable effect. A commit is authorized only when freshness, causal priority, effect binding, and commit eligibility still hold at the boundary.

3 Commit-Boundary Model

  • An authority witness licenses derived state, which can include plans, cached targets, staged writes, or shared-memory entries; a commit makes an effect durable outside private scratch space.Derived state retains commit entitlement only while its witness remains live, current, bound to the same target, and eligible.Source: §3 · p. 4
  • A protected commit requires a current witness, completed predecessors, the same concrete target, and a live authorizing path.The four checks are freshness, causal priority, effect binding, and commit eligibility; failure of any one makes a successful endpoint an unauthorized commit.Source: §3 · p. 4
  • When authority is lost, the runtime can refresh the witness, rebind the target, or replan; otherwise it must withhold the durable effect.Internal updates need not be ordered unless they justify an externally consequential effect, and hidden state never emitted by the runtime remains outside the model.Source: §3 · pp. 4–5
  • A runtime needs boundary evidence for the authorizing witness, dependencies, target binding, and continued path eligibility to distinguish safe from unsafe endpoint lookalikes.The required evidence can be represented by runtime signals such as epochs, version witnesses, branch identifiers, or capabilities.Source: §3 · p. 4

4 Experimental Setting

The evaluation holds the user goal and payload shape fixed while changing whether authority remains valid before commit. Its main measurement is a 270-row, 54-task controlled-invalidation matrix, with smaller subsets for mechanism, control, and boundary checks.

4 Experimental Setting

  • The primary matrix covers 54 tasks—18 each in browser, tool/state, and multi-agent settings—with one clean control and four unguarded perturbations per task, for 270 rows.The reference stack is LangGraph with Qwen2.5-7B-Instruct; unguarded runs add no revalidation, version binding, replanning, or commit gate beyond the prompt.Source: §4 · p. 5
  • The 270-row matrix supplies headline rates, while fixed paired comparisons, trace reviews, negative controls, and boundary studies answer narrower mechanism and diagnostic questions.Additional external-workflow and route/model panels are artifact diagnostics, not primary behavioral evidence.Source: §4 · pp. 5–6
  • Each scenario combines an authority witness, an invalidator, and a durable effect, spanning distinct witnesses and effects across the three workflow families.The commit-surface audit identified recurring needs for page or version freshness, target binding, callback order, and branch or path eligibility.Source: §4 · p. 5
  • Perturbations change timing or authority while preserving the requested endpoint, payload shape, and nominal task difficulty.The shared stressors include callback reorder, delayed tool response, check/use invalidation, expiry, cache or visibility skew, and late branch cancellation.Source: §4 · pp. 5–6
  • The suite deliberately induces authority invalidation, so its separability results are not estimates of deployment prevalence.The results should be read against the clean row for the same task.Source: §4 · p. 6
  • An authorized completion must reach the goal and retain boundary-time evidence for freshness, binding, causal priority, and eligibility; aborting or replanning after authority loss is safe non-completion.Optimality, full serializability, and maximal caution are outside this outcome label.Source: §4 · pp. 6–7

5 Main Result: Endpoint Success and Authorized Completion Diverge

Across the controlled-invalidation matrix, endpoint success and commit authorization diverge sharply, while clean controls remain authorized. Fixed matched comparisons hold endpoint success constant as authorization changes, supporting the interpretation that the gap reflects temporal invalidation rather than task difficulty.

5 Main Result: Endpoint Success and Authorized Completion Diverge

  • Browser reached the endpoint in 89/90 runs but only 19/90 remained authorized; tool/state reached it in 83/90 with 18/90 authorized; multi-agent reached it in 90/90 with 18/90 authorized.All 54/54 clean controls remained authorized, and all unauthorized commits occurred in invalidating rows.Source: §5 · p. 7, Table 8 · p. 8
  • In the fixed 108-row comparison, every run reached the endpoint, but only 54/108 were authorized controls while 54/108 invalidating perturbations were unauthorized.The selector retained each task's clean control and validation-to-commit perturbation without selecting rows based on outcomes.Source: §5 · p. 7, Figure 2 · p. 9
  • Across 18 matched control/perturbation pairs, all pairs flipped from authorized control to unauthorized perturbation, with no reverse flips (exact sign test p = 7.6×10−6).All 12/12 runs in each family reached the endpoint, while only 6/12 per family remained authorized.Source: §5 · p. 8, Table 10 · p. 8
  • All 18/18 controls and 36/36 benign perturbations remained authorized, with 0/54 unauthorized commits and 0/54 infrastructure failures.The authority-preserving variants included benign delay, repaint without retargeting, format-only changes, callback delay without reorder, and branch delay without cancellation.Source: §5 · p. 8, Table 11 · p. 8
  • 94.3–98.5% endpoint success contrasted with 16.0–25.6% authorized completion and 92.3–97.8% unauthorized commits among invalidating rows (Wilson 95% CIs).The primary matrix is the headline measurement; its rates are not deployment-prevalence estimates.Source: §5 · p. 7, Table 8 · p. 8, Figure 2 · p. 9
  • Endpoint-only scoring misses distinct boundary failures: stale but plausible state, the wrong target, unresolved dependency order, or an ineligible path.Schedule-pressure and route/model diagnostics can shift runs between unauthorized commit and safe non-completion, but do not change the primary claim.Source: §5 · p. 9
  • Across all three task families, matched comparisons hold endpoint success fixed while authorization changes, supporting temporal invalidation rather than task difficulty as the interpretation of the gap.Trace review inspects unsafe cases for evidence of authority loss, stale dependency reuse, or eligibility failure; it is an attribution check, not another rate estimate.Source: §5 · pp. 7–9

6 Mitigation and COMMITGUARD

Mitigations work when they repair the validity condition that failed or stop the effect at the commit boundary. COMMITGUARD enforces that boundary using runtime-emitted evidence, while accepting safe aborts when authorization cannot be restored.

Mitigation comparison

  • In the three calibrated probes, revalidation, version binding, and prompt caution each miss hazards they do not repair, while replanning and commit gating eliminate unauthorized commits.Pre-execution revalidation helps repaint drift but misses stale approvals; version binding helps approval drift but misses repaint drift; prompt caution does not restore runtime entitlement.Source: §6 · p. 10

Blocking and recovery

  • The main price of stronger mitigation is refusal after authority loss; recovery is available when a fresh witness can be re-established before commit.The design target is blocking stale effects first, with recovery a secondary path.Source: §6 · pp. 10–11

Runtime contract

  • The monitor requires an effect identifier, authority witness, dependency projection, target binding, eligibility path, freshness predicate, and commit primitive; missing signals make decisions non-observable and fail closed.Suppressing any required signal makes all 36 commit decisions non-observable, blocking 18 unsafe commits while also losing 18 authorized decisions.Source: §6 · p. 11

Boundary monitor

  • COMMITGUARD refreshes boundary evidence and aborts when freshness, causal priority, effect binding, or eligibility fails; repair mode can refresh, rebind, or recompute eligibility.The final check must be atomically coupled to the durable effect to avoid introducing a new check/commit race.Source: §6 · p. 11

COMMITGUARD results

  • 18/18 clean controls remain authorized, while enforcement leaves 0/36 unsafe commits and moves all 18/18 perturbed rows to guarded abort.In matched replay, enforcement converts the 18 shadow-unauthorized runs into guarded aborts; revalidation restores authorized commit when a fresh witness is available.Source: §6 · pp. 11–12

Boundary effect and cost

  • In the 180-run matched replay, enforcement reduces unauthorized-commit rate from 0.80 to 0 while leaving average latency roughly unchanged at 597 ms across paired cells.In the fixed 18-task run, enforcement changes success rate from 0.972 to 0.5 and unauthorized-commit rate from 0.472 to 0; shorter runs mostly reflect earlier aborts, not higher throughput.Source: §6 · p. 12

Validity-core ablation

  • Ablations show the validity core matters: dropping eligible, fresh, and valid_until lets 18/18 unauthorized replay rows through, while removing revalidation makes 18/18 repaired rows unauthorized again.The full monitor blocks 18/18 unauthorized replay rows and preserves 18/18 authorized rows.Source: §6 · p. 12

Reporting implications

  • Evaluations should distinguish endpoint success, authorized completion, unauthorized commit, safe non-completion, and infrastructure failure because these outcomes imply different remediation paths.The repair-map comparison is diagnostic rather than a deployed-monitor decision procedure, and does not promise easy recovery at scale.Source: §6 · pp. 10, 12

7 Discussion

The discussion situates commit-time authorization as a broader agentic TOCTOU boundary, where authority can propagate through derived state before a durable effect. Its claims are bounded by controlled stress tests and observable runtime evidence.

TOCTOU and agent workflows

  • Agent executions can carry authority into plans, cached targets, branch outputs, or shared memory, so invalidation may leave the endpoint plausible while derived state loses commit entitlement.Single-condition controls are incomplete: pre-action recheck misses later approval drift, while version binding misses semantic retargeting.Source: §7 · p. 12

Model configuration

  • Model and framework changes shift behavior while the boundary property remains; capability cannot substitute for fresh witnesses, binding information, and commit gates.Among open/local rows passing the clean-control gate, Llama-3.1-8B preserves the authorized-control/unauthorized-perturbation split, while Mistral-7B and framework variation move more perturbed rows into safe non-completion.Source: §7 · p. 12

Limits and trace coverage

  • The measurements are controlled authority-invalidation stress tests, not deployment-prevalence estimates; the bounded claim is that endpoint success and authorized completion can diverge after invalidation.Authorization is assessed from emitted witnesses, dependency edges, target bindings, and eligibility markers.Source: §7 · p. 12
  • Without observable witness and dependency-path signals, endpoint success cannot certify safety, so commit-time authorization claims should be limited to effects whose paths runtimes can observe.The main matrix's 207 unsafe commits carry commit events with stale freshness, failed eligibility, an invalidator, a target, and a witness.Source: §7 · pp. 12–13

Reporting and open directions

  • Future evaluations should report endpoint success, authorized completion, unauthorized commit, safe non-completion, and infrastructure failure separately, and identify the setting and failed validity condition.Open directions include hardening COMMITGUARD into an always-on monitor, broader enterprise and multimodal evaluation, and treating cost, interruption, and latency as safety–utility trade-offs.Source: §7 · p. 13

8 Related Work

Related work spans agentic stale-state and security studies, transactional runtime control, and agent capability evaluations. This paper distinguishes its focus as whether temporary authority remains entitled to license an effect after passing through derived state.

TOCTOU and temporal failures

  • The closest empirical TOCTOU studies show agents can act on stale or racy state; this work instead measures whether authority carried through plans, cached targets, staged writes, branches, or shared memory still licenses commit.The measured path is witness to derived state to durable effect.Source: §8 · p. 13

Transactional and runtime control

  • Transactional ordering, replay, tracing, and runtime validation are complementary: they help implement or inspect safer runtimes, while COMMITGUARD addresses whether old authority still licenses the final effect.COMMITGUARD is described as a fail-closed boundary monitor for that question.Source: §8 · p. 13

Agent safety and benchmarks

  • Agent-safety benchmarks map prompt injection, tool misuse, trust boundaries, memory steering, and other subversion channels, while this paper isolates temporal authorization at the durability boundary.Its question is when a once-valid witness stops licensing commit after authority has passed through derived state.Source: §8 · p. 13

Evaluation and systems precedents

  • Web, GUI, software, and multi-agent evaluations cover mutable long-horizon workflows, but their primary metric is usually endpoint completion; classical systems work supplies precedents in revocation, concurrency, and provenance.The distinctive issue is that witnesses can license action several reasoning and tool steps before final commit.Source: §8 · p. 13

9 Conclusion

The conclusion frames authorized commit as distinct from visible task success: authority must remain valid across the path from witness through derived state to durable effect. Boundary enforcement depends on observable runtime signals and should fail closed or report non-observability when they are absent.

Conclusion

  • Commit-time authorization requires the licensing witness to remain fresh, causally prior, bound to the same effect, and eligible at the durability boundary.With emitted signals, enforcement turns stale commits into guarded aborts; without them, systems should fail closed or report non-observability.Source: §9 · p. 13

Ethical Considerations

Experiments use synthetic, instrumented sandboxes and non-production workflows, while the paper identifies dual-use risks and focuses its artifact on defensive monitoring. The intended beneficiaries include agent developers, platform operators, affected users, and safety researchers.

Ethical Considerations

  • All experiments use instrumented sandboxes with synthetic data and non-production workflows; reported effects persist only within the experimental harness.No real payment systems, user accounts, production services, or third-party resources were modified.Source: Ethical Considerations · p. 14
  • The main risk is dual use because the identified timing and authority-propagation patterns could be abused against deployed agents.The artifact emphasizes controlled reproductions, boundary evidence, and defensive monitoring rather than exploit automation.Source: Ethical Considerations · p. 14
  • Agent developers, platform operators, affected users, and safety researchers are the named stakeholders; the intended benefit is measurable authorization failures and fail-closed runtime design.The paper justifies disclosure on the grounds that hazards are structural and defense requires runtime support.Source: Ethical Considerations · p. 14

Open Science

The standalone artifact supports inspection and audit through evidence, review, and prototype materials while excluding sensitive or superseded content. The appendices map the benchmark, boundary evaluator, and reproducibility checks.

Open Science

  • The artifact repository groups paper-facing figures and evidence manifests, audit packets and trace dossiers, and the COMMITGUARD prototype and evidence summaries.The prototype includes an installable Python 3.10+ package using only the standard library, plus replay, recovery, exact-witness, and surface-ablation summaries.Source: Open Science · p. 14
  • Designed for inspection and audit, the artifact omits superseded runs, quarantined outputs, credentials, production endpoints, and non-synthetic data.JSON entry-point paths are rewritten to remain inside the artifact; the repository also retains manuscript build and count-validation targets.Source: Open Science · p. 14
  • Closed-model and dedicated-endpoint diagnostics are separated from reproducible open/local evidence, with prompts and runtime metadata included only where redistribution permits.Omitted materials are listed by scope in the artifact README and manifests.Source: Open Science · p. 14

Appendices

  • The appendices map benchmark organization, state the boundary criterion and evaluator, and record selectors, diagnostics, reproducibility hooks, and count checks.They add audit structure without reproducing the full artifact.Source: Appendices · p. 19

A Benchmark Organization

The benchmark organizes 54 tasks across browser, tool/state, and multi-agent workflows, with clean controls and invalidating perturbations. Its evaluator determines authorization at commit by checking the witnesses and derived states that still justify each effect.

A Benchmark Organization

  • Each of 54 tasks has one clean control and four invalidating perturbations, yielding 270 unguarded executions across three families, six semantic buckets per family, and three tasks per bucket.The 18-task trace-review set supports attribution and examples, while fixed paired inspection uses all 54 tasks and their validation-to-commit perturbations.Source: A Benchmark Organization · p. 19
  • Browser tasks use page or DOM epochs, selected targets, and session markers, with repaint, retargeting, expiry, and navigation drift as invalidators.The six buckets span account/auth, commerce, dashboard/settings, document flow, navigation/search, and scheduling.Source: A Benchmark Organization · p. 19
  • Tool/state tasks use approval epochs, ETags, leases, versions, and branch refs; revocation, version advance, check/use drift, and stale callbacks invalidate authority.The family covers access/secrets, approval/policy, database/API, deploy/release, incident/ops, and repository/config.Source: A Benchmark Organization · p. 19
  • Multi-agent tasks rely on worker results, branch and callback IDs, barrier tokens, and shared memory, with reorder, TTL expiry, visibility skew, and branch cancellation as invalidators.Its buckets span incident/routing, memory/cache, pipeline/verification, planning/review, policy/guardrail, and speculation/branching.Source: A Benchmark Organization · p. 19

B Boundary Criterion and Evaluator

  • A derived state is commit-valid only when every authority witness remains fresh, causally current, bound to the intended effect, and eligible at that time.For a commit, the trace authorizes the effect only if every derived state still justifying it remains commit-valid.Source: B Boundary Criterion and Evaluator · p. 19
  • The evaluator projects each consequential effect's commit, witness-bearing state, dependency edges, target binding, and eligibility path, then classifies authorized completion, unauthorized commit, safe non-completion, or infrastructure failure.Boundary evidence includes witness validity windows or versions, dependency edges, target bindings, and approval or live-eligibility signals; hidden dependencies count as non-observability, not safety.Source: B Boundary Criterion and Evaluator · p. 19

C Selectors, Diagnostics, and Reproducibility

Selectors fix the primary denominators and paired comparisons before inspecting outcomes, while diagnostic mitigation mapping targets specific boundary violations. The count checks distinguish high endpoint success from authorized completion.

C Selectors, Diagnostics, and Reproducibility

  • The fixed paired comparison retains every clean control and that task's validation-to-commit perturbation across 54 tasks, for 108 executions.The selector is fixed by hazard class rather than ranking cases by endpoint success, unauthorized commit, leakage score, or schedule pressure.Source: C Selectors, Diagnostics, and… · p. 19
  • The diagnostic repair map pairs observation-to-action drift with pre-execution revalidation, validation-to-commit drift with version pinning, and dependency or leakage violations with commit-gated execution.Stale visibility or shared-state skew maps to freshness-aware replanning; the selector is label-aware and does not determine COMMITGUARD's decision rule.Source: C Selectors, Diagnostics, and… · pp. 19–20
  • The authority-preserving check uses 54 executions with benign delays or restyling that leave witnesses, bindings, dependency order, and eligibility valid.Route and model panels vary one axis at a time and count as diagnostics unless clean-control and infrastructure gates pass.Source: C Selectors, Diagnostics, and… · p. 20
  • The artifact's main inspection surfaces are evidence manifests, audit packets and trace dossiers, and the COMMITGUARD prototype and boundary-monitor package.It is organized around artifact_manifest.json.Source: C Selectors, Diagnostics, and… · p. 20
  • 262 endpoint successes comprise 55 authorized completions and 207 unauthorized commits; the remaining 8 executions are safe non-completions.The 270-run matrix contains 54 clean controls and 216 invalidating executions; paired inspection uses 108 executions, trace review 72 stress executions, and the authority-preserving check 54 executions.Source: C Selectors, Diagnostics, and… · p. 20
Loading 2607.10487v1…