Governing Dynamic Capabilities: Cryptographic Binding and Reproducibility Verification for AI Agent Tool Use
Open accessAbstract
AI agents dynamically acquire tools, orchestrate sub-agents, and transact across organizational boundaries, yet no existing security layer verifies what an agent can do, whether it executed what it claims, or what happened in a multi-agent interaction. We trace this gap to the capability-context separation: inside a transformer, tool definitions and user context are indistinguishable tokens, but at the orchestration layer they have fundamentally different security semantics. Existing frameworks conflate the two, enabling silent capability escalation and leaving interactions without verifiable provenance. From this principle we derive three Agent Governance Requirements: capability integrity (G1), behavioral verifiability (G2), and interaction auditability (G3), defining what a governed agent ecosystem must enforce, independent of how. We prove two structural results: the Chain Verifiability Theorem (one unverifiable interior agent breaks end-to-end verification for all downstream nodes) and the Bounded Divergence Theorem (replay-based verification yields a probabilistic safety certificate, epsilon <= 1 - alpha^{1/n}). We validate with two crypto-agnostic instantiations -- basic (Ed25519, SHA-256; 97 us verify) and enhanced (BBS+ selective disclosure, Groth16 DV-SNARK; 13.8 ms) -- both satisfying nine security properties. A reproducibility study (9 models, 7 providers) reveals 5.8x variance in inference determinism, connecting model characteristics to governance architecture. End-to-end evaluation over 5-20 agent pipelines confirms <0.02% overhead and detection of all attack scenarios with zero false positives.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Governing Dynamic Capabilities binds an agent certificate to a commitment over its model, tools, and permissions, invalidates access after a capability-set change, and records signed hash-linked interactions in a trust tree.
“Governing Dynamic Capabilities binds an agent certificate to a commitment over its model, tools, and permissions, invalidates access after a capability-set change, and records signed hash-linked interactions in a trust tree [40].”
From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [40]
Section 3.1 defines a certificate with a model binding and a skills manifest containing tool permissions; Theorem 5 says access is denied when the runtime capability hash differs from the certificate hash. Definitions 8–9 describe signed, hash-linked interaction records in a verifiable interaction ledger, not in the trust propagation tree described in §3.3. The claim conflates those two structures. (LLM, conf=0.88)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 20
- A. Karvonen et al., "DiFR: Inference Verification Despite Nondeterminism," arXiv:2511.20621, 2025. https://arxiv.org/abs/2511.20621 · arXiv
- Z. Lin, S. Zhang, G. Liao, D. Tao, T. Wang, "Binding Agent ID: Unleashing the Power of AI Agents with Accountability and Credibility," arXiv:2512.17538, 2025. https://arxiv.org/abs/2512.17538 · arXiv
- T. South et al., "Authenticated Delegation and Authorized AI Agents," ICML 2025 (Position), arXiv:2501.09674. https://arxiv.org/abs/2501. 09674 · arXiv
- S. N., "OpenID Connect for Agents (OIDC-A) 1.0: A Standard Extension for LLM-Based Agent Identity and Authorization," arXiv:2509.25974, 2025. https: //arxiv.org/abs/2509.25974 · arXiv
- T. South et al., "Identity Management for Agentic AI," OpenID Foundation, arXiv:2510.25819, 2025. https://arxiv.org/abs/2510.25819 · arXiv
- D. R. Alves, "EigenAI: Deterministic Inference, Ver- ifiable Results," arXiv:2602.00182, 2026. https:// arxiv.org/abs/2602.00182 · arXiv
- C. Schnabl et al., "Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Envi- ronments," arXiv:2506.23706, 2025. https://arxiv. org/abs/2506.23706 · arXiv
- "Improving Google A2A Protocol: Protecting Sensi- tive Data and Mitigating Unintended Harms in Multi- Agent Systems," arXiv:2505.12490, 2025. https: //arxiv.org/abs/2505.12490 · arXiv
- "Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents," arXiv:2509.13597, 2025. https://arxiv.org/abs/2509.13597 · arXiv
- C. Schroeder de Witt et al., "Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents," arXiv:2505.02077, 2025. https://arxiv.org/abs/2505.02077 · arXiv
- M. Blaze, J. Feigenbaum, J. Lacy, "Decentralized Trust Management," Proc. IEEE S&P, 1996. https: //dl.acm.org/doi/10.1109/SECPRI.1996.502679 · DOI
- L. Chuat et al., "F-PKI: Enabling Innova- tion and Trust Flexibility in the HTTPS Public-Key Infrastructure," Proc. NDSS, 2022. https://www.ndss-symposium.org/ndss-paper/ auto-draft-249/
- D. Basin et al., "ARPKI: Attack Resilient Public-Key Infrastructure," Proc. CCS, 2014. https://dl.acm. org/doi/10.1145/2660267.2660298 · DOI
- S. Wrótniak, H. Leibowitz, E. Syta, A. Herzberg, "Provable Security for PKI Schemes," Proc. CCS, 2024. https://eprint.iacr.org/2019/807
- S. Raza, R. Sapkota, M. Karkee, C. Emmanouilidis, "TRiSM for Agentic AI: A Review of Trust, Risk, and Security Management in LLM-based Agentic Multi-Agent Systems," AI Open, vol. 7, pp. 71-95, 2026. https://www.sciencedirect.com/science/ article/pii/S2666651026000069
- "Trusted AI Agents in the Cloud," arXiv:2512.05951, 2025. https://arxiv.org/abs/2512.05951 · arXiv
- Y. Ding, "Decentralized Multi-Agent System with Trust-Aware Communication," arXiv:2512.02410, 2025. https://arxiv.org/abs/2512.02410 · arXiv
- E. C. Cheng, J. Cheng, A. Siu, "Toward Safe and Responsible AI Agents: A Three-Pillar Model for Transparency, Accountability, and Trustworthiness," arXiv:2601.06223, 2026. https://arxiv.org/abs/ 2601.06223 · arXiv
- E. Allegrini, A. Shreekumar, Z. B. Celik, "Formalizing the Safety, Security, and Functional Properties of Agentic AI Systems," arXiv:2510.14133, 2025. https: //arxiv.org/abs/2510.14133 · arXiv
- S. Ghosh et al., "A Safety and Security Framework for Real-World Agentic Systems," arXiv:2511.21990, 2025. https://arxiv.org/abs/2511.21990 · arXiv
Cited by
Sorted by citations
Zhu, G., & Wang, C. (2026) · arXiv · doi:10.48550/arxiv.2610.00347
- Authors
- Zhou, Z.
- Corresponding author
- Zhou, Ziling
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2603.14332
- OpenAlex
- W7138303066
- Cited by
- 0
- References
- 0
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Keywords
- AI agent governance, dynamic capabilities, reproducibility verification, multi-agent systems, provenance verification, replay verification, Ed25519, agent security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
