PaperlayerView exact revision on arXiv

Source-linked AI summary

Separating Disclosure from Authorization: Field-Tier Minimization for Agent Action Mediation

Jiten Oswal, John Cadeddu

arXiv:2608.25474v1cs.CRcs.SE

TL;DR

Authorization and audit requirements can force sensitive action parameters into mediation systems and immutable ledgers. The paper separates them through field-tier minimization, a pre-minimization canonical digest, and generated shared schemas, while documenting leakage checks and residual trust. Its strongest claims remain bounded by one client language, private-pilot deployment, and trust in the client-computed digest.

  • Problem

    Authorization needs parameter-derived policy inputs, while auditing needs a durable commitment to what happened; naive designs place raw parameters in an append-only ledger.

  • Method

    The design classifies fields into raw-policy, projected-derived, and workload-only payload tiers, computes a digest before minimization, and generates disclosure artifacts from one declaration.

  • Results

    8 of 19 fields, 42%, never cross in raw form in the classified corpus, while six identifying fields cross only through derived projections.

  • Takeaways & Limitations

    Pre-minimization commitments make disclosure policy mutable over an immutable record without reopening historical hashes or changing offline verification.

  • Takeaways & Limitations

    The strongest guarantee currently holds for one client language, while the system is deployed only in a small number of private pilots and trusts the client’s digest.

Abstract

from arXiv · show

A system that authorizes an action must see enough of it to decide, and a system that attests to its decision must record enough to be audited. Both pressures push raw action parameters -- recipients, payment memos, record identifiers -- into an append-only ledger that cannot delete them. We show the two are separable. We classify each parameter field, not each action class, into three tiers: fields a policy may legitimately match on, which cross raw; fields that are policy-relevant but identifying, which cross only as projections such as an email domain or a templated route shape; and fields with no legitimate policy use, which never leave the workload. The central property is that the ledger's commitment is a canonical digest of the full, unminimized parameters, computed before minimization runs. The commitment is therefore independent of the tier table: reclassifying a field changes what is disclosed without invalidating a historical entry, reopening a hash, or altering what an offline verifier checks. Tier table, policy schema and wire schema are generated from one per-action declaration, so the deciding and recording parties cannot hold different rules. We then address a question the architecture forces: which party should compute each attested fact? We argue it is settled by which party could lie about it undetectably, and derive three answers within one request -- the client computes the parameter digest, being the only party holding the data; it is structurally prevented from naming the definition that governed it, since that would write a false statement into a signed ledger; and it attests which tier table it applied, so divergence is detectable. We give a leakage analysis of each projection, report an incident in which a first-cut projection preserved the identifier it was written to remove, and state the residual trust the design does not eliminate.

1 Introduction

The paper separates authorization from disclosure by keeping raw parameters out of mediation and the permanent ledger while preserving an auditable commitment to what happened. Its design combines field-level minimization with a pre-minimization digest and shared generated schemas, while acknowledging deployment and client-language limits.

  • The problem: Naively authorizing and auditing an agent action places recipients, subjects, bodies, and other raw parameters into mediation services and append-only logs.The ledger is difficult to alter because entries are hash-linked, signed, and retained for years.
  • The problem: Redaction makes the ledger commit to less than what happened, hashing everything prevents policy matching, and encryption leaves plaintext recoverable to key holders.These alternatives fail to satisfy both auditability and selective policy evaluation.
  • Core claim: The design separates the pressures: policy evaluates predicates over parameters, while the ledger records a commitment to parameters rather than their values.Only values needed for policy reasons cross the boundary, and identifying values can cross as non-identifying projections.
  • Scope: The paper applies the design in a runtime governance system for enterprise AI agents, but reports operation only through a small number of private pilots.This deployment scope limits what the paper can claim about broader use.
  • Core design: The ledger commits to a digest of raw parameters before minimization, making disclosure policy retrofittable and re-tierable without reopening historical hashes or changing offline verification.Reclassification changes the minimized disclosure path while leaving the commitment path unchanged.
  • Core design: A single per-action declaration generates the tier table, policy schema, and wire schema, preventing the deciding and recording parties from holding different rules.The paper also frames disclosure and authorization as distinct protections: deny-by-default addresses authorization, not disclosure.

3 Field-tier minimization

Field-tier minimization classifies individual parameters rather than whole action types, allowing policy-relevant abstractions to cross while retaining identifying or irrelevant raw values in the workload. Projections are explicit, fail closed when uncertain, and are independently computed from the raw input alongside the digest.

  • 3.1 The unit is the field: Classifying whole action types fails because one action can contain identifying, policy-relevant, non-identifying, and irrelevant fields.For example, an email recipient may require policy evaluation while the subject and body need not cross.
  • 3.2 Three tiers: The three tiers are policy, where raw non-identifying values cross; derived, where policy-relevant identifying values cross as projections; and payload, which never crosses.Unclassified fields are dropped and folded only into the digest, with no default tier.
  • 3.2 Three tiers: Derived fields expose strict abstractions such as an email domain while withholding the identifying local part.The derived tier is treated as explicit declassification from high payload data to low policy data.
  • 3.3 The projections: The projection library includes recipient domains, allowlist-based payee booleans, endpoint hosts, and route-shape abstractions, with unparseable or absent inputs failing closed.Recipient values never cross for payee_known, and malformed recipient or missing allowlist cases produce denying values.
  • 3.3 The projections: The digest and minimization computations share raw parameters but no other state, so re-tiering changes disclosure without reopening historical hashes or affecting offline verification.This fork is the basis for digest independence.
  • 3.3 The projections: A first-cut resource-path projection was corrected by dropping the final segment entirely after a leak guard found that sanitization preserved the identifier.The incident illustrates why projections must be tested against serialized output and why string cleaning depends on enumerating formats.

4 Digest independence

The ledger commits to a canonical digest of the full parameters before minimization, making the commitment independent of disclosure tiers. Tier changes therefore alter disclosed attributes without changing historical verification.

  • The ledger’s commitment is computed over full original parameters before minimization, not over the minimized view.The digest and size are computed by the client using canonical serialization and SHA-256.
  • The ledger’s commitment does not depend on the tier table.Reclassifying fields changes what crosses the boundary but not what the ledger committed to.
  • Tier changes are purely additive: no historical entry’s hash changes, and the offline verifier remains unchanged.Verification continues over the same signed, hash-linked bytes.
  • Minimization is retrofittable: entries written before minimization remain valid, comparable, and verifiable against later entries.This supports adoption in systems with already-populated ledgers.
  • An auditor with candidate parameters can confirm the exact committed parameter set without knowing the tier table.The entry proves that a client holding parameters with digest H requested action A and that the mediator decided D.
  • The commitment does not prove that the mediator saw the raw parameters, leaving residual trust in the design.The mediator is intentionally prevented from receiving them.

5 One declaration, three artifacts

Independently maintained schemas and tier tables can drift, creating invisible disagreements about validation and disclosure. The design generates all three artifacts from one declaration, while testing exposed weaknesses in the initial generator checks and leaves a cross-language qualification.

  • 5.1 The drift problem: Independent policy, tier, and wire artifacts can drift, causing unmatched policies, unvalidated attributes, or invisible disclosure disagreements.A server and client can each behave correctly according to inconsistent copies while disclosing different fields.
  • 5.1 The drift problem: A duplicated tier table in the Python SDK actually drifted from the system’s intended rules.The incident demonstrates that the drift failure was operational rather than hypothetical.
  • 5.2 Generation from one declaration: A single per-action declaration now generates the tier table, policy schema, and wire schema.The declaration specifies each field’s tier, schema, Cedar type, and projections for derived fields.
  • 5.2 Generation from one declaration: The second-language SDK lacks runtime definition distribution and applied-tiers attestation, so its strongest disclosure-rule guarantee relies on conformance tests rather than construction.The guarantee currently holds by construction for one client language and by testing for the other.
  • 5.3 An aside on testing generators, which we got wrong first: The initial equivalence test became vacuous after the hand-written tier table was deleted, leaving forty-nine assertions unable to detect generator errors.The test compared the generator against itself rather than an independent reference.
  • 5.3 An aside on testing generators, which we got wrong first: A golden corpus of hand-written literals replaced the vacuous test because meaningful checks must retain evidence that they can fail.The corpus also tests that identifying values appear nowhere in minimized output, preventing input-preserving projections.

6 Who computes what: an asymmetry principle

The party computing an attested fact should be the one unable to lie about it undetectably. Applied within one request, this assigns parameter-digest computation to the client, definition derivation to the server, and tier-table attestation to both parties through comparison.

  • The asymmetry principle assigns computation to the party that cannot lie about the attested fact undetectably.
  • 6.1 The parameter digest: the client computes it, and is trusted: The client computes the parameter digest because it is the only party holding the raw parameters.The server records the client-reported digest, creating an explicit trust concession.
  • 6.1 The parameter digest: the client computes it, and is trusted: The design preserves independent verification while leaving clients unable to prove that their parameter digest covered the parameters they actually used.Customers can recompute the digest locally, but the mediator cannot verify the client’s preimage without receiving raw parameters.
  • 6.2 The action definition: the server derives it: The server derives the action definition because allowing the client to name it could create a false statement in the signed ledger.Strict request schemas reject unknown keys, preventing clients from supplying the definition.
  • 6.3 The applied tier table: the client attests, the server compares: The client and server compare digests over the applied and authorized tier rules to detect disclosure-rule divergence.Both sides hash normalized tiers and sorted projection names rather than arbitrary wire data.

7 Disclosure is not authorization

Authorization and disclosure are separate control questions: deny-by-default can refuse unauthorized actions without limiting what authorized actions disclose. A disclosure floor restores workload-side veto power when tenant-extensible catalogs can widen disclosure at runtime.

  • 7.1 Deny-by-default protects one and not the other: Deny-by-default protects authorization but provides no protection against unwanted disclosure.The same policy table can drive both decisions, making the asymmetry easy to overlook.
  • 7.1 Deny-by-default protects one and not the other: Re-tiering an unused sensitive field can send its raw value into the ledger on every later request without changing policy or deployment.In the reference corpus, send_email.subject is free text and referenced by no policies.
  • 7.2 The trust inversion: Tenant-extensible catalogs let administrators change every agent’s disclosure immediately, without code review.
  • 7.3 The disclosure floor: A disclosure floor caps what a workload will send, while the catalog may narrow disclosure but never widen it past that floor.
  • 7.3 The disclosure floor: The floor is off by default, trading weaker security posture for a mechanism that can function without prior configuration.

8 Leakage analysis

The leakage analysis shows that projections reduce disclosure without eliminating all contextual or semantic information. In a corpus of 19 fields across five action types, 8 fields—42%—never cross in raw form, while projections expose policy-relevant abstractions with stated residuals.

  • 8.1 Per-projection: Projections can reveal organizations, service categories, route purposes, or subject categories despite removing direct identifiers.Recipient domains, endpoint hosts, route shapes, and directory prefixes each retain different residual information.
  • 8.1 Per-projection: payee_known discloses one allowlist-membership bit and is the strongest projection because it exactly matches the policy question.
  • 8.2 The corpus, quantified: The corpus contains 19 fields across 5 action types, including two free-text payload fields unused by its policies.Those fields are the email subject and payment memo.
  • 8.2 The corpus, quantified: 8 of 19 fields, 42%, never cross in raw form because six identifying fields are represented by derived attributes.The six derived fields produce seven projected attributes because endpoint data yields both host and route-shape abstractions.
  • 8.2 The corpus, quantified: The corpus quantification is a checkable description of the authors’ reference policies, not evidence about policy distributions elsewhere.
  • 8.4 An incident: the projection that returned its input: A first resource-path projection preserved patient-record-778812, showing that segment-wise sanitization can miss embedded identifiers.The leak guard caught the failure, and the fix dropped the final path segment instead of cleaning it.
  • 8.4 An incident: the projection that returned its input: Dropping a whole structural component is more robust than removing sensitive substrings, but it prevents policies from matching filenames or extensions.The accepted boundary permits directory containment rules but not rules reaching *.csv files.

9 Limits and residual trust

The design leaves residual trust and scope boundaries: clients control their own parameter digest, static tiers lack context dependence, and deployment evidence comes from private pilots. The authors report structural guarantees but not broad adoption or generality.

  • A policy over the full path may fail after projection to a directory, and operators must notice the missing attribute in the schema.
  • Minimization does not defend against a compromised workload that discloses through its own network connections.
  • Static per-field tiers cannot express context-dependent sensitivity, such as a field becoming sensitive only for external recipients.
  • An auditor can match a candidate parameter set to the client’s digest but cannot establish that the client hashed the parameters it actually used.The design instead attests the applied disclosure rules and keeps the definition beyond the client’s reach.
  • A zero-knowledge proof of correct projection is proposed but not built as the principled way to make digests and minimized attributes jointly checkable.
  • The system is deployed in a small number of private pilots rather than as a general release.The authors treat this as deliberate because governance requirements are learned through close deployment work.
  • The reported structural properties do not depend on deployment scale, but the paper does not claim tier sufficiency, projection completeness, or operator behavior at scale.

10 Related work

The paper distinguishes field-level disclosure minimization from authorization and logging, positioning its mechanism between stronger cryptographic approaches and conventional storage-layer controls. Its contribution is attesting which declassification policy was applied while preserving an immutable commitment to raw data.

  • The mechanism uses static per-field classification and library enforcement, while adding attestation of the declassification policy applied.
  • The design minimizes fields before they cross the trust boundary, rather than redacting or protecting them only after storage.
  • Raw-parameter commitments preserve evidence that write-time redaction would otherwise weaken by committing only to a redacted view.
  • Unlike redactable signatures, this design prevents sensitive values from entering signed form before mediation and ledger boundaries.
  • Transparency logs provide the append-only, externally verifiable ledger model but do not address mutable disclosure policies for publicly logged objects.
  • Compared with zero-knowledge and anonymous-credential approaches, the projections provide weaker cryptographic guarantees but require no trusted setup and only a library change.

11 Conclusion

The conclusion separates authorization from attestation through raw commitments and field-tier minimization, then derives attestation responsibilities from which party could lie undetectably. It also emphasizes that disclosure controls require independent treatment from authorization controls.

  • The mediation point need not expose identifying values: policy engines need predicates, while ledgers need commitments.
  • Computing the commitment over raw parameters makes disclosure policy mutable without invalidating historical records or offline verification.
  • Attested facts should be computed by the party unable to lie about them undetectably, a principle the paper suggests may generalize.
  • The tier table is a disclosure decision that deny-by-default authorization controls do not protect, requiring separate disclosure controls.

Data availability

The reference implementation is intended to make the paper’s projection and leakage claims executable, but it is not yet available and excludes internal governance components outside the verification surface.

  • The planned MIT-licensed artifact will include the five projections, per-action tier declarations, and applied-tiers digest.
  • The artifact is intended as a frozen paper companion rather than a supported library, and its projection set may diverge from the authors’ system.
  • The mediator internals, policy corpus, and catalog registry API are excluded because the paper identifies them as outside its verification surface.
  • The reported values come from a golden corpus whose literals are pinned in the test suite rather than serving as illustrations.

A.1 send_email

The send_email example commits to raw parameters before minimizing them, then exposes only policy-relevant raw or projected fields to evaluation and attestation. Sensitive subject content remains outside the workload boundary except through the commitment.

  • A.1 send_email: SHA-256(JCS(parameters)) commits to the exact raw parameter object before classification or other processing.
  • A.1 send_email: The send_email tier table classifies recipient, body_size_bytes, attachment_hashes, and subject as derived, policy, derived, and payload fields.
  • A.1 send_email: The minimized output retains recipient_domain, body_size_bytes, and attachment_count, while omitting the subject from serialized output and the ledger.
  • A.1 send_email: The serialized-output test checks that the recipient name, subject, and patient identifier appear nowhere under any key.
  • A.1 send_email: The SDK attests the applied-tiers digest, which the server recomputes from its authorized definition and compares.
  • A.1 send_email: Cedar evaluates only generated attributes, so recipient_domain can match while no subject-line policy can be written.
  • A.1 send_email: The event records the action, decision, matched policy, applied-tiers digest, and raw-parameter hash for exact auditor confirmation.
Loading 2608.25474v1…