PaperlayerView exact revision on arXiv

Source-linked AI summary

Agent Approval Laundering: Transitive Effects Beyond the Approved Invocation

Jinqian Zhang, Haojun Xia, Shujiang Wu, Jingkun Yue, Xia Zhang, Zhangpei Cheng, Bibo Tu

arXiv:2609.28586v1cs.CRcs.SE

TL;DR

Coding-agent approval records can identify an invocation while omitting effects exercised by its transitive workflow. The paper formalizes and measures this gap, then evaluates binding frozen, source-backed predictions before authorization; on holdout workflows, this reduces residual effects from 10 to 3.

  • Problem

    Approval records bind entry invocations, but whether they cover the transitive operational effects of the activated workflow has not been measured.

    Source: §I · p. 1

  • Method

    The paper formalizes closure-bound approval and measures approval records against execution evidence, then evaluates preauthorization records binding frozen effect predictions and provenance.

    Source: §I · p. 2

  • Results

    On 17 prespecified holdout workflows, binding frozen predictions reduced residual effect instances from 10 to 3, with 0.926 macro recall and 0.941 macro precision.

    Source: §I · p. 2

  • Takeaways & Limitations

    Authorization should bind the invocation, predicted transitive effect boundary, and provenance before deciding, and preserve that commitment through execution and audit.

    Source: §IX · p. 14

Abstract

from arXiv · show

Coding-agent approval interfaces bind a human decision to a command or tool call, while developer tools execute the transitive workflow that invocation activates. Package installation can run lifecycle hooks and write files; an MCP call can exercise network authority. We call the resulting record-coverage failure approval laundering: the durable record names the entry invocation but omits effects exercised by its workflow. We present the first systematic security analysis of this record-to-closure relation in agent systems. We formalize closure-bound approval over six effect classes and derive an information limit: identical policy-visible fields can require different effect-specific decisions, so no record-only policy can guarantee both. The Approval-to-Action Security Benchmark binds approval objects and decision-time metadata to post-execution evidence. Across 111 fixed approval-object/trace pairs, residual records fall from 40 under explicit fields to 17 with command semantics and 13 with decision-time metadata. Across 11 fixed-SHA executions, the ladder reaches zero metadata residuals; two exact mappings recur across three product frontends. For prospective recovery, effect-bound records commit frozen, source-backed predictions and provenance before authorization. On 17 prespecified holdout workflows, predictions achieve 0.926 macro recall and 0.941 macro precision; binding them cuts residual effects from 10 to 3. A Claude Code PreToolUse integration carries the frozen record through the permission path without automatic approval. These results establish approval laundering as a measurable, recurrent record-coverage failure despite truthful invocation identity. They motivate binding each invocation before authorization to a source-backed prediction of its workflow's transitive effect boundary and preserving that binding with the decision.

I. INTRODUCTION

Approval records can truthfully identify an entry invocation while omitting effects of the transitive workflow it activates. The paper formalizes this coverage gap, measures it across approval views, and evaluates prediction-based recovery before authorization.

I. INTRODUCTION

  • Approval laundering is a record-coverage failure: a truthful entry-invocation record can omit effects exercised by its transitive workflow, making some effect-specific decisions impossible from the record alone.The paper formalizes closure-bound approval over six operational effect classes and derives a record-only indistinguishability result.Source: §I · pp. 1–2
  • 40 of 111 approval-object/trace pairs omit an observed effect under explicit fields, versus 17 with command semantics and 13 with decision-time metadata.Across 11 fixed-SHA executions, residuals fall from 10 to 2 to 0; two exact mappings recur across four runs and three product frontends.Source: §I · p. 2
  • On 17 holdout workflows, binding frozen predictions reduces residual effect instances from 10 to 3, with 0.926 macro recall and 0.941 macro precision.The predictions achieve 13/17 exact effect sets versus 9/17 for the command-only baseline.Source: §I · p. 2

II. THE APPROVAL-REPRESENTATION LADDER

  • The representation ladder moves from explicit fields to generic command semantics to instance-specific metadata, with Vite and MCP exposing successive gaps.In Vite, command semantics recover a file effect omitted by explicit fields, but conservatively predict network too; Fig. 2 depicts that trade-off.Source: §II · p. 2, A. Explicit-Field Gap: Vite · p. 2, Figure 2 · p. 3

B. Command-Residual Gap: MCP

The MCP case shows that generic tool-call semantics can leave a network effect unrepresented even when the invocation is identified. The section connects this residual to a transaction model that separates decision-time approval information from the later execution closure.

B. Command-Residual Gap: MCP

  • In the fixed-SHA MCP case, the named tool call exercises network authority beyond the represented MCP capability, and both explicit-field and command-aware views leave network uncovered.The instance-specific .mcp.json identifies the configured transport before execution, locating the gap between generic invocation semantics and inspectable workflow metadata.Source: B. Command-Residual Gap: MCP · pp. 3–4
  • Vite and MCP mark successive representation gaps: command semantics recover Vite’s omitted file effect, while MCP metadata recovers an effect omitted by generic command semantics.The section frames their common target as coverage of effects reachable through the approved workflow.Source: B. Command-Residual Gap: MCP · pp. 3–4

A. Approval Transaction and Execution Closure

  • The decision-time approval object commits the exact machine-readable basis before final authorization; the sealed record preserves that basis and the final outcome.Post-execution evidence may be appended, but it does not become decision-time information.Source: A. Approval Transaction and Execution… · p. 4
  • The execution closure includes causally attributable traces from invocation start until workflow termination, quiescence, or another independently mediated request.It includes effects produced before a failed workflow terminates and by attributable descendants.Source: A. Approval Transaction and Execution… · p. 4
  • Valid binding commits the invocation, expansion-source contents and digests, toolchain identity, and initial-state snapshot to the same transaction as the record.Different committed content or identity requires a new decision context.Source: A. Approval Transaction and Execution… · p. 4

B. Threat Model

The threat model treats expansion-bearing artifacts and configurations as potentially adversarial while assuming the approval path preserves invocation identity and record integrity. Closure-bound coverage is a one-sided test, and indistinguishable policy inputs cannot guarantee different effect-specific decisions.

B. Threat Model

  • Expansion sources may be adversarially controlled or influenced, while the trusted approval path binds the launched invocation and seals an immutable record without guaranteeing effect completeness.The model includes artifacts, local configuration or state, and referenced implementations; executed workflow code is assumed unable to forge externally preserved measurement objects.Source: B. Threat Model · pp. 4–5
  • Documented toolchain expansion points make the threat model practical, including package scripts and MCP configuration that selects a transport and server endpoint.The fixed-SHA executions confirm that existing paths generate transitive closures requiring approval coverage.Source: B. Threat Model · p. 5

C. Closure-Bound Approval and Witnessed Violation

  • A structural witness occurs when a permitted, validly bound trace exercises an effect label omitted from the record; adversarial success additionally requires adversarial control to induce that omitted label.The same coverage predicate applies to ordinary expansion and adversarial exploitation; the regimes differ in source control.Source: B. Threat Model · p. 4, C. Closure-Bound Approval and… · p. 5
  • One observed structural witness falsifies closure-bound approval for its fixed context, while a run without a witness cannot establish the property over the entire reachable closure.The empirical test is one-sided.Source: C. Closure-Bound Approval and… · p. 5
  • When identical policy-visible inputs require different effect-specific outcomes, a record-only policy cannot guarantee both, even with randomization.Without separating information, the decision path must conservatively represent the union, re-mediate, reject, or contain unresolved effects.Source: C. Closure-Bound Approval and… · pp. 5–6

D. Six-Class Operationalization

The operationalization measures approval coverage using six coarse effect labels, distinguishing representation-layer completeness from other policy dimensions.

D. Six-Class Operationalization

  • The six-class vocabulary covers process, file, environment, network, container, and MCP effects; MCP denotes a client-observed protocol capability or successful named tool call.Destination, intent, severity, credentials, and product-contract status remain separate policy dimensions.Source: D. Six-Class Operationalization · p. 6
  • The labels span operations, mutation, resource boundaries, and protocol capability, while coverage measures completeness only at this abstraction.RQ3 pairs coverage with precision and additional-approval rates to measure conservative disclosure against selectivity.Source: D. Six-Class Operationalization · p. 6
  • The benchmark compares each approval-object/trace pair, deriving effect labels from post-execution evidence rather than treating a package as the observation.Mechanism classes describe invocation expansion; effect labels describe the resulting operation, mutation, resource boundary, or protocol capability.Source: D. Six-Class Operationalization · p. 6
  • The metadata view is evaluated as a fixed recoverability view, then the later prediction stage commits its metadata-derived assertion before the decision.The resulting prediction is preserved in the approval record.Source: D. Six-Class Operationalization · p. 6

IV. THE APPROVAL-TO-ACTION SECURITY BENCHMARK

The benchmark compares approval-record coverage across fixed captured fields and richer decision-time information, using immutable post-execution evidence to assess transitive effects. Its pipeline preserves the distinction between coverage evidence and the additional evidence needed for a permission-bearing witness.

IV. THE APPROVAL-TO-ACTION SECURITY BENCHMARK

  • The benchmark holds each approval-object/trace pair fixed while comparing explicit-field, command-aware, and metadata-aware views.Richer views estimate counterfactual decision-time recoverability; the captured approval object remains unchanged.Source: §IV · p. 6

A. Benchmark Overview and Temporal Pipeline

  • Post-execution evidence scores effects against either the captured approval basis or a prediction frozen before execution, never changing either decision-time input.For captured instances, the pipeline preserves the approval object, invocation, source snapshot, and initial state; only afterward are trace evidence and effects derived.Source: A. Benchmark Overview and Temporal… · p. 6, Figure 3 · p. 7

B. Unit of Analysis and Evidence Strata

C. RQ1: Approval-Record Coverage

RQ1 measures how approval-record coverage changes as decision-time information is enriched. Explicit fields leave observed effects unrepresented across the benchmark’s mechanism classes, while command semantics and metadata reduce—but do not eliminate—the residuals.

C. RQ1: Approval-Record Coverage

  • The frozen predictor includes the command/surface baseline and labels inferred from transitive metadata, while post-execution collectors ground effect labels in observed artifacts.The operational projection covers process, file, environment, network, container, and MCP effects; environment and MCP labels have specific inclusion criteria.Source: C. RQ1: Approval-Record Coverage · p. 8
  • Across the same 111 canonical records, residuals fell from 40 under the captured explicit-field view to 17 after generic command semantics and 13 after raw metadata; all 13 remaining records belonged to the harness/parser fixture stratum, and all nine mechanism classes had explicit-field gaps.The same-corpus gradient isolates the contribution of each information layer.Source: C. RQ1: Approval-Record Coverage · p. 8

V. FIXED-SHA RECURRENCE ACROSS PROJECTS AND CODING-AGENT FRONTENDS

  • The section next tests whether the representation gradient persists in fixed-SHA public projects and whether exact mappings recur across frontends.The planned comparison proceeds from individual fixed-SHA executions to mappings observed at the same repository revision across distinct frontends.Source: §V · p. 8

A. Fixed-SHA Workflow Recurrence

Fixed-SHA executions show that command semantics reduce, but do not fully remove, residual records; post hoc metadata removes the remainder in this set. Two exact effect mappings recur across product frontends, while a shared-fixture control tests whether capture differences create apparent gaps.

A. Fixed-SHA Workflow Recurrence

  • A deterministic scan of nine public repositories found 81 mechanism-bearing metadata findings before protocol selection fixed eight repository–mechanism cases.Those cases contributed 11 imported executions, evaluated individually for coverage gaps.Source: A. Fixed-SHA Workflow Recurrence · p. 9

B. Cross-Frontend Exact-Mapping Recurrence

  • The shared-fixture control retains 40 evidence-complete records and yields 0/40 strict gaps across five frontends after excluding inherited-canary reads and fixture-authored protocol-shaped events.This rules out capture-created strict gaps across the tested shared fixtures.Source: B. Cross-Frontend Exact-Mapping… · p. 9, Figure 4 · p. 10
  • Exact mappings count as recurrent only when two codebook-valid executions of the same fixed-SHA case under distinct frontends produce the same represented-to-observed mapping.Prompt wording, local paths, and model backend are recorded attributes, not matching criteria.Source: B. Cross-Frontend Exact-Mapping… · p. 9

A. Fixed-SHA Workflow Recurrence

  • 10→2→0 residual records remain across 11 fixed-SHA runs under explicit fields, command semantics, and post hoc metadata.All eight cases have at least one explicit-field gap; the two command-aware residuals are successful MCP calls, and metadata covers them.Source: A. Fixed-SHA Workflow Recurrence · p. 9, Table II · p. 10

B. Cross-Frontend Exact-Mapping Recurrence

  • Vite P→P,F and MCP M→M,N each recur under two frontends; the four qualifying runs span Claude Code, GitHub Copilot CLI, and Qwen Code.Vite resolves under command semantics, whereas MCP remains command-residual; both resolve under metadata-aware views.Source: B. Cross-Frontend Exact-Mapping… · p. 9, Figure 4 · p. 10

VI. PRE-EXECUTION RECOVERY AND EFFECT-BOUND RECORDS

The section evaluates whether source-backed, frozen decision-time metadata can predict transitive effects before authorization. On the paired holdout, metadata improves effect recovery over command-only predictions.

A. Prospective Protocol and Freeze Discipline

  • The frozen parser reads local project and referenced-script metadata while excluding benchmark reports, execution traces, observed-effect files, and harness instrumentation.The command-only baseline instead sees the prompt-visible invocation and maps generic command semantics to a conservative effect set.Source: A. Prospective Protocol and Freeze… · p. 10
  • Before Confirmatory B, the team froze parser v1.1, the protocol, source and rule hashes, and both prediction sets; primary outcomes did not alter them.The development sequence preserved Natural-A errors to develop v1.1 before freezing the confirmatory materials.Source: A. Prospective Protocol and Freeze… · p. 10, B. Development Cohorts · p. 11

C. Prespecified Confirmatory Holdout B

  • Confirmatory B prespecified 18 workflows from unseen fixed-SHA repositories; 17 reached target execution and formed the prediction-accuracy denominator.One case failed during setup and supplied no realized effect set.Source: C. Prespecified Confirmatory Holdout B · p. 11
  • A separate verifier reconstructed all 17 target-executed effect sets from 109 hash-checked artifacts with zero effect-set or artifact-hash mismatches.Six prespecified cases rerun three times each had mean pairwise effect-set Jaccard 1.000.Source: C. Prespecified Confirmatory Holdout B · p. 11
  • Metadata raises macro recall from .770 to .926 at the same .941 macro precision, with exact-set matches rising from 9/17 to 13/17 through four repairs and zero regressions.Figure 5 tracks the paired exact-set transitions across the 17 target-executed cases.Source: Figure 5 · p. 11, C. Prespecified Confirmatory Holdout B · p. 11

D. Effect-Bound Approval Record

Effect-bound records commit frozen effect predictions and provenance before authorization, preserving that binding in the durable record. In Confirmatory B, binding predictions improved disclosure, and the evaluated integration carried the record through an existing approval path without automatic approval.

D. Effect-Bound Approval Record

  • The record binds the invocation, frozen prediction, metadata sources and hashes, parser/rule provenance, routing outcome, and final permission outcome before appending execution evidence for audit.Post-execution evidence cannot retroactively become approval-time disclosure.Source: D. Effect-Bound Approval Record · p. 11

E. Approval-Path Integration and Policy Operating Point

  • The evaluated policy routes requests with induced mechanisms, added effects, or warnings to ASK, delegates to the existing permission flow, and never autoallows.The Claude Code PreToolUse run returned ASK to a noninteractive permission path, which returned DENY; the workspace remained hash-identical.Source: E. Approval-Path Integration and… · p. 12
  • The record-level disclosure gain is independent of the policy consumer, separating effect representation from the policy-specific routing demand.The evaluated consumer routed every positive and all but one control to ASK.Source: E. Approval-Path Integration and… · p. 12
  • Binding frozen predictions raises case-macro coverage from .755 to .922 and reduces residual effect instances from 10 to 3, disclosing seven additional effect instances.The seven newly disclosed instances occur in the positive stratum, while control disclosure remains unchanged.Source: E. Approval-Path Integration and… · p. 12

VII. DISCUSSION

  • The discussion frames binding before the decision, enforcing from the bound record, and containing execution to that boundary as a forward-only transaction chain.It presents browser, SaaS/API, and nested-agent systems as possible extensions when effect vocabularies, inspectable decision-time sources, activation evidence, and post-execution evidence are available.Source: §VII · pp. 12–13

VIII. RELATED WORK

Related work constrains authority, identity, delegation, and execution, while this paper isolates whether a durable approval record covers the selected invocation’s transitive effects. The conclusion recommends binding predicted effects and provenance before authorization; the ethics discussion highlights deployment and release boundaries.

VIII. RELATED WORK

  • Closure-bound approval measures whether the decision-time record covers transitive effects, distinct from prior work on task authority, action identity, and execution control.The paper distinguishes its question from AuthBench’s task-level authority and Consent Integrity’s exact action binding.Source: §VIII · p. 13

IX. CONCLUSION

  • The conclusion recommends binding the invocation, predicted effect boundary, and provenance before authorization, while preserving that commitment through execution and audit.The paper’s information limit is that identical policy-visible inputs can require different effect-specific decisions.Source: §IX · pp. 13–14

ETHICS CONSIDERATIONS

  • Deployment can create false assurance, approval fatigue, or metadata exposure, so the paper recommends staged, reversible rollout and review of unresolved risks.The preprint provides no public artifact URL, experiment ledger, or raw execution captures.Source: ETHICS CONSIDERATIONS · p. 14

APPENDIX A SUPPLEMENTARY EXPERIMENTAL EVIDENCE

The appendix separates evidence sources and denominators while auditing retrospective record coverage, prospective recovery, and evidence reconstruction. Its results show reduced residuals under richer representations and report frozen predictions and approval-path integration outcomes.

A. Claim Evidence and Denominator Accounting

  • 10/11 fixed-SHA executions have explicit-field residuals, falling to 2/11 with command semantics and 0/11 with decision-time metadata; across 111 records, residuals fall from 40 to 17 to 13.The fixed-SHA views cover the same 11 evidence-complete executions; one was already non-residual under explicit fields.Source: Figure 6 · p. 16, A. Claim Evidence and Denominator… · p. 16
  • Two exact mappings recur across three product frontends, spanning four runs, and both recurrent mappings have hash-bound evidence.The mappings are P→P,F and M→M,N.Source: A. Claim Evidence and Denominator… · p. 16
  • The mutually exclusive 111-record partition comprises 60 harness/parser records, 40 cross-frontend construct-control cells, and 11 fixed-SHA executions.The construct control contributes zero strict gaps; the fixed-SHA recurrence uses its own denominator.Source: A. Claim Evidence and Denominator… · p. 16
  • Among 18 prespecified Confirmatory B workflows across 18 repositories, 17 reach target execution, yielding recall 0.926, precision 0.941, exact-set accuracy 0.765, and control precision 0.875.Source: A. Claim Evidence and Denominator… · p. 16
  • An independent verifier hash-checks 109 raw artifacts and exactly reconstructs all 17 target-executed effect sets with zero mismatches.The remaining setup failure is marked NOT_EXECUTED; the pre-B protocol freezes parser, source/rule hashes, and both prediction sets before outcomes.Source: A. Claim Evidence and Denominator… · p. 17, Figure 7 · p. 17
  • Binding frozen predictions raises disclosed-effect coverage from 0.755 to 0.922 and reduces residual effect instances from 10 to 3; the permission-path integration emits ASK and receives a denial.The hook run leaves the workspace unchanged and has no automatic allow.Source: A. Claim Evidence and Denominator… · p. 17

APPENDIX B SECONDARY AUDIT ANALYSES

The appendix clarifies metric denominators and examines how cohort stability and alternative terminal-state or cache treatments affect Confirmatory-B estimates. It keeps development cohorts distinct from the frozen confirmatory cohort.

A. Metric Definitions and Denominators

  • Figure 8 separates v1.0 development cohorts from the frozen v1.1 Confirmatory-B cohort; its whiskers show fixed-cohort resampling stability intervals, not population confidence intervals.The figure reports cohort-level macro recall and precision.Source: Figure 8 · p. 18
  • The primary Confirmatory-B metrics use 17 target-executed workflows; sensitivity profiles compare 18/9 all-terminal, 13/6 successful-only, and 18/9 cache-excluded cases/controls.Macro recall and precision average case-level scores equally; the additional non-executed workflow remains in protocol accounting.Source: Figure 9 · p. 18, A. Metric Definitions and Denominators · p. 18
  • The empty-observed case contributes zero residuals and is excluded only from the undefined per-case coverage ratio.Sixteen of the 17 target-executed cases have nonempty observed effect sets.Source: A. Metric Definitions and Denominators · p. 18

B. Prospective Cohort Error Profiles

Prospective cohort analyses localize prediction errors across workflow classes and test Confirmatory-B sensitivity to denominator and scoring choices. The reported results distinguish development cohorts from the primary target-executed confirmatory cases.

B. Prospective Cohort Error Profiles

  • Controlled v1.0 class recall/precision range from Cargo’s 1.000/0.833 to MCP’s 0.583/1.000 across six positive-control class pairs.The cohort also includes IDE, npm, PEP 517, and shell classes.Source: B. Prospective Cohort Error Profiles · p. 19
  • Natural A has exact-set accuracy 0.167; five missed file effects and five extra environment predictions dominate its errors.The cohort has ten successful executions and two evidence-complete command failures.Source: B. Prospective Cohort Error Profiles · p. 19
  • Across 17 target-executed Confirmatory-B cases, three miss a file effect, while one process effect and one MCP effect are extra.Table X organizes prospective cohort errors by effect class and missed or extra status.Source: B. Prospective Cohort Error Profiles · p. 19, Table X · p. 19

C. Confirmatory-B Sensitivities

  • Treating NOT_EXECUTED as empty yields recall/precision/exact-set accuracy 0.931/0.889/0.722, while successful-only scoring yields 0.942/0.923/0.769.For the empty-observed case, recall is 0.926, 0.922, or 0.868 depending on whether it is scored as one, excluded, or scored as zero; precision and exact sets remain unchanged.Source: C. Confirmatory-B Sensitivities · p. 19
Loading 2609.28586v1…