ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?
Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.
The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.
- Identifies that identical permissions and reachability can still require opposite post-revocation decisions
- Proves exponentially many future-distinct states share a fixed transitive closure
- Fixed 256-token summaries solved 0-2 of 16 agent episode pairs across four open-weight models
- Authenticated current-query reads solved 15-16 of 16 pairs
- Hard gating eliminated all eight observed unauthorized effects in evaluation
From the original article
1 min read at arxiv.orgTool-using language agents can delegate and revoke permissions while acting through external services. We show that two authorization histories can have identical current permissions and identical all-pairs reachability yet require opposite decisions after the same direct-edge revocation. We formalize the information needed to preserve such distinctions as a residual authorization state.
By Moonwon Choi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.