CoChat
Sign Up
PreprintCited by 1Access Control and TrustDistributed systems and fault toleranceAdvanced Authentication Protocols Security

AID-Guard: Stateful Authorization for Delegated Agent Effects

Open access
Tong, Yingzhe, Dai, Leyu, Guo, Songhui·2026·arXiv
DOI 10.48550/arxiv.2608.21159arXiv 2608.21159
Open this paper in CoChat — free accountOpen PDF

Abstract

Tool-using AI agents turn delegated tasks into provider effects, yet authorization often ends at admission while provider state, delivery, retry, and recovery evolve. A request may change before commit, or response loss may cause a replacement to create a second effect from one approval. We present AID-Guard, a stateful authorization-to-effect closure protocol. It revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result or certified no effect with a delivery fence. For supported provider contracts, one reservation yields at most one effect across retry and recovery. To our knowledge, it is the first evaluated agent-authorization protocol to unify these controls in one lifecycle. We implement a Python/SQLite prototype. In a declared loopback MCP domain, 13 live mutations caused no unauthorized provider effects, three concurrent histories were linearizable, and evidence bundles supported public verification and replay. All 210 Stripe provider-contract trials matched predeclared outcomes. Across Stripe and Resend, 40 terminalize-successor schedules, 30 overlapping races, and 10 crash-recovery schedules completed without duplicate effects. Under complete proposer compromise, AID-Guard blocked 44/44 attacks and admitted 44/44 matched legitimate proposals. Its strict exact-manifest profile reduced benign utility by 35.4 to 43.8 percentage points; a typed frontier recovered 9-10 completions without observed unsafe effects. A composition study blocked 20/20 post-admission lifecycle attacks and preserved 8/8 valid or exact-retry executions. The results support authorization-to-effect binding under the evaluated effect-path inventory, provider contracts, and failure schedules.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2608.21159

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 27

  1. K. Hines, G. Lopez, M. Hall, F. Zarfati, Y. Zunger, and E. Kiciman, "Defending against indirect prompt injection attacks with spotlighting," 2024. [Online]. Available: https://arxiv.org/abs/2403.14720 · arXiv
  2. E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr, "Defeating prompt injections by design," 2025. [Online]. Available: https://arxiv.org/abs/2503.18813 · arXiv
  3. T. Shi, J. He, Z. Wang, L. Wu, H. Li, W. Guo, and D. Song, "Progent: Programmable privilege control for LLM agents," 2025. [Online]. Available: https://arxiv.org/abs/2504.11703 · arXiv
  4. R. K. Sharma, L. Jiang, Z. Lin, and S. Chen, "PAuth: Precise task-scoped authorization for agents," 2026. [Online]. Available: https://arxiv.org/abs/2603.17170 · arXiv
  5. I. Santos-Grueiro, "Context-to-execution integrity for LLM agents," 2026. [Online]. Available: https://arxiv.org/abs/2607.06000 · arXiv
  6. J. Xu, L. Fan, Z. Wang, X. Li, and H. Liu, "Beyond single-use tokens: Durable authorization state for replay-resistant LLM agent actions," 2026. [Online]. Available: https://arxiv.org/abs/2608.01710 · arXiv
  7. E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr, "AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents," in Advances in Neural Information Processing Systems, vol. 37, 2024, datasets and Benchmarks Track. [Online]. Available: https://proceedings.neurips.cc/paper files/p aper/2024/hash/97091a5177d8dc64b1da8bf3e1f6fb54-Abstract-Dataset s and Benchmarks Track.html
  8. Z. Ji, D. Wu, W. Jiang, P. Ma, Z. Li, Y. Gao, S. Wang, and Y. Li, "Taming various privilege escalation in LLM-based agent systems: A mandatory access control framework," 2026. [Online]. Available: https://arxiv.org/abs/2601.11893 · arXiv
  9. P. Wang, Y. Li, and Y. Tian, "Aligning provenance with authorization: A dual-graph defense for LLM agents," 2026. [Online]. Available: https://arxiv.org/abs/2605.26497 · arXiv
  10. M. Costa, B. Köpf, A. Kolluri, A. Paverd, M. Russinovich, A. Salem, S. Tople, L. Wutschitz, and S. Zanella-Béguelin, "Securing AI agents with information-flow control," 2025. [Online]. Available: https://arxiv.org/abs/2505.23643 · arXiv
  11. E. Li, T. Mallick, E. Rose, W. Robertson, A. Oprea, and C. Nita-Rotaru, "ACE: A security architecture for LLM-integrated app systems," in Network and Distributed System Security Symposium (NDSS), 2026. [Online]. Available: https://www.ndss-symposium.org/ndss-paper/ace-a -security-architecture-for-llm-integrated-app-systems/
  12. Y. Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal, "IsolateGPT: An execution isolation architecture for LLM-based agentic systems," 2024. [Online]. Available: https://arxiv.org/abs/2403.04960 · arXiv
  13. C. Bühler, M. Biagiola, L. D. Grazia, and G. Salvaneschi, "Securing AI agent execution," 2025. [Online]. Available: https: //arxiv.org/abs/2510.21236
  14. I. Santos-Grueiro, "Temporary authority, permanent effects: Commit- time authorization for LLM agents," 2026. [Online]. Available: https://arxiv.org/abs/2607.10487 · arXiv
  15. Z. Chen, H. Liu, D. Xu, D. Dong, J. Li, B. Pu, and J. Zhai, "Cordon: Semantic transactions for tool-using LLM agents," 2026. [Online]. Available: https://arxiv.org/abs/2606.17573 · arXiv
  16. X. Muruaga, "Bounded agents: Delegation security for multi-agent AI systems," 2026. [Online]. Available: https://arxiv.org/abs/2608.15888 · arXiv
  17. Y. Zhang, "Agent libos: A runtime substrate for capability- controlled self-evolving LLM agents," 2026. [Online]. Available: https://arxiv.org/abs/2606.03895 · arXiv
  18. S. Prakash, "AIP: Agent identity protocol for verifiable delegation across MCP and A2A," 2026. [Online]. Available: https://arxiv.org/abs/2603.2 4775
  19. G. Syros, A. Suri, J. Ginesin, C. Nita-Rotaru, and A. Oprea, "SAGA: A security architecture for governing AI agentic systems," in Network and Distributed System Security Symposium (NDSS), 2026. [Online]. Available: https://www.ndss-symposium.org/ndss-paper/saga-a-securit y-architecture-for-governing-ai-agentic-systems/
  20. A. Birgisson, J. G. Politz, Ú. Erlingsson, A. Taly, M. Vrable, and M. Lentczner, "Macaroons: Cookies with contextual caveats for decentralized authorization in the cloud," in Network and Distributed System Security Symposium (NDSS), 2014. [Online]. Available: https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/mac aroons-cookies-contextual-caveats-decentralized-authorization-cloud/
  21. N. Hardy, "The confused deputy (or why capabilities might have been invented)," ACM SIGOPS Operating Systems Review, vol. 22, no. 4, pp. 36-38, 1988.
  22. A. Dawoud and S. Bugiel, "DroidCap: OS support for capability- based permissions in Android," in Network and Distributed System Security Symposium (NDSS), 2019. [Online]. Available: https://www.ndss-symposium.org/ndss-paper/droidcap-os-support-for-c apability-based-permissions-in-android/
  23. O. Bajaber, B. Ji, and P. Gao, "NetCap: Data-plane capability-based defense against token theft in network access," in Network and Distributed System Security Symposium (NDSS), 2026. [Online]. Available: https://www.ndss-symposium.org/ndss-paper/netcap-data-pla ne-capability-based-defense-against-token-theft-in-network-access/
  24. C. Lee, S. J. Park, A. Kejriwal, S. Matsushita, and J. K. Ousterhout, "Implementing linearizability at large scale and low latency," in 25th ACM Symposium on Operating Systems Principles (SOSP), 2015, pp. 71-86.
  25. H. Garcia-Molina and K. Salem, "Sagas," in ACM SIGMOD International Conference on Management of Data, 1987, pp. 249-259.
  26. P. Helland, "Life beyond distributed transactions: An apostate's opinion," in 3rd Biennial Conference on Innovative Data Systems Research (CIDR), 2007, pp. 132-141. [Online]. Available: https: //www.cidrdb.org/cidr2007/papers/cidr07p15.pdf
  27. S. A. Crosby and D. S. Wallach, "Efficient data structures for tamper-evident logging," in 18th USENIX Security Symposium (USENIX Security 09). Montreal, Quebec: USENIX Association, Aug. 2009. [Online]. Available: https://www.usenix.org/conference/usenixsecurity09 /technical-sessions/presentation/efficient-data-structures-tamper-evident

Cited by

Sorted by citations

Authors
Tong, Y., Dai, L., & Guo, S.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2608.21159
arXiv
2608.21159
OpenAlex
W7204145614
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Computer Networks and Communications › Distributed systems and fault tolerance
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
Keywords
supplier contracts, crash recovery, linearizability, replay verification, stripes

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review