ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?
Open accessAbstract
With revocable delegation, two histories can yield identical current permissions yet require opposite decisions for the same query after the same revocation. We introduce ResidualAuth, a theory-grounded framework characterizing the authorization state agent systems must preserve and evaluating its maintenance and use. Its formal core, residual authorization state, equates histories exactly when every future sequence of grants, revocations, and uses is valid after both or neither. We prove that exponentially many distinct residual states can nevertheless agree on who can reach whom through delegation paths. The analysis also yields exact or tight memory bounds as delegation redundancy varies and an average decision-error lower bound under an explicit bound on retained information. ResidualAuth evaluates information access, online state maintenance, and information use through a restricted executable benchmark and separate diagnostics. The benchmark pairs episodes differing in authorization-relevant history and requiring opposite decisions; pair accuracy requires both answers to be correct. To test use of supplied decisions, four open-weight models received trusted current-query Allow/Deny decisions alongside deterministic 256-token event extracts, achieving 15-16/16 correct pairs versus 0-2/16 with extracts alone. Memory diagnostics identified invalid reconstructions; models also answered incorrectly from valid memories that passed fixed future authorization tests. Together, these results distinguish what future authorization requires a system to retain from whether agents can access relevant information, maintain state across updates, and use available information to make correct decisions.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
ResidualAuth characterizes why future-correct revocation requires authorization history beyond current reachability.
“ResidualAuth further characterizes why future-correct revocation requires authorization history beyond current reachability [6].”
From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [6]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 28
- Martín Abadi, Michael Burrows, Butler Lampson, and Gordon Plotkin. A calculus for access control in distributed systems. ACM Transactions on Programming Languages and Systems, 15(4):706- 734, 1993.
- Andrew W. Appel and Edward W. Felten. Proof-carrying authentication. In Proceedings of the 6th ACM Conference on Computer and Communications Security, pp. 52-62, 1999.
- Avik Chaudhuri and Deepak Garg. PCAL: Language support for proof-carrying authorization systems. In Computer Security -ESORICS 2009, volume 5789 of Lecture Notes in Computer Science, pp. 184-199. Springer, 2009.
- Marcos Cramer, Pieter Van Hertum, Diego Agustin Ambrossio, and Marc Denecker. Modelling delegation and revocation schemes in IDP. arXiv preprint arXiv:1405.1584, 2014. · arXiv
- Panduranga Sai Varma Dantuluri and Jyotirmoy Sundi. Delegation without trust: An empirical gap analysis of identity, authorization, and runtime governance in multi-agent LLM systems. arXiv preprint arXiv:2609.00267, 2026. · arXiv
- Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. arXiv preprint arXiv:2406.13352, 2024. · arXiv
- Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design. arXiv preprint arXiv:2503.18813, 2025. · arXiv
- Aarya Doshi, Yining Hong, Congying Xu, Eunsuk Kang, Alexandros Kapravelos, and Christian Kästner. Towards verifiably safe tool use for LLM agents. arXiv preprint arXiv:2601.08012, 2026. · arXiv
- Linfeng Fan, Ziwei Li, Yuan Tian, Yichen Wang, Rongsheng Li, and Xiong Wang. The granularity mismatch in agent security: Argument-level provenance solves enforcement and isolates the LLM reasoning bottleneck. arXiv preprint arXiv:2605.11039, 2026. · arXiv
- Åsa Hagström, Sushil Jajodia, Francesco Parisi-Presicce, and Duminda Wijesekera. Revocations: A classification. In Proceedings of the 14th IEEE Computer Security Foundations Workshop, pp. 44-58, 2001.
- Amjad Ibrahim and Yong Li. Overlaying governance: A compositional authorization framework for delegation and scope in agentic AI. arXiv preprint arXiv:2606.03518, 2026. · arXiv
- Shawn Li, Chenxiao Yu, Han Wang, Wei Yang, Ryan Rossi, Franck Dernoncourt, Xiyang Hu, Philip Yu, Chaowei Xiao, Huan Zhang, and Yue Zhao. FORTIS: Benchmarking over-privilege in agent skills. arXiv preprint arXiv:2605.09163, 2026. · arXiv
- Junchi Liao. Auditing provenance sensitivity in LLM agent action selection. arXiv preprint arXiv:2607.20827, 2026. · arXiv
- Xabier Muruaga. Bounded agents: Delegation security for multi-agent AI systems. arXiv preprint arXiv:2608.15888, 2026. · arXiv
- John Myhill. Finite automata and the representation of events. WADC Technical Report 57-624, Wright Air Development Center, pp. 112-137, 1957.
- Anil Nerode. Linear automaton transformations. Proceedings of the American Mathematical Society, 9(4):541-544, 1958.
- Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. MemGPT: Towards LLMs as operating systems. arXiv preprint arXiv:2310.08560, 2023. · arXiv
- Zhe Ren, Yibo Yang, Yimeng Chen, Zijun Zhao, Benshuo Fu, Zhihao Shu, Bingjie Zhang, Yangyang Xu, Dandan Guo, and Shuicheng Yan. GateMem: Benchmarking memory governance in multi- principal shared-memory agents. arXiv preprint arXiv:2606.18829, 2026. · arXiv
- Piotr Sankowski. Dynamic transitive closure via dynamic matrix inverse (extended abstract). In Proceedings of the 45th Annual IEEE Symposium on Foundations of Computer Science, pp. 509-517, 2004.
- Igor Santos-Grueiro. Lingering authority: Revocable resource-and-effect capabilities for coding agents. arXiv preprint arXiv:2606.22504, 2026. · arXiv
- Tianneng Shi, Jingxuan He, Zhun Wang, Hongwei Li, Linyu Wu, Wenbo Guo, and Dawn Song. Progent: Securing AI agents with privilege control. arXiv preprint arXiv:2504.11703, 2025. · arXiv
- Tobin South, Samuele Marro, Thomas Hardjono, Robert Mahari, Cedric Deslandes Whitney, Dazza Greenwood, Alan Chan, and Alex Pentland. Authenticated delegation and authorized AI agents. arXiv preprint arXiv:2501.09674, 2025. · arXiv
- Peiran Wang, Ying Li, and Yuan Tian. Aligning provenance with authorization: A dual-graph defense for LLM agents. arXiv preprint arXiv:2605.26497, 2026. · arXiv
- Jinghan Xu, Longze Fan, Zeyuan Wang, Xinjin Li, and Hankai Liu. Beyond single-use to- kens: Durable authorization state for replay-resistant LLM agent actions. arXiv preprint arXiv:2608.01710, 2026a. · arXiv
- Wujiang Xu, Yu Wang, Kai Mei, Kaiqu Liang, Zhenting Wang, Mingyu Jin, Han Zhang, Shi-Xiong Zhang, Wenyue Hua, Sambit Sahu, and Dimitris N. Metaxas. MemGym: A long-horizon memory environment for LLM agents. arXiv preprint arXiv:2605.20833, 2026b. · arXiv
- Kaiyue Yang, Yuyan Bu, Jingwei Yi, Yuchi Wang, Biyu Zhou, Juntao Dai, Songlin Hu, and Yaodong Yang. When lower privileges suffice: Investigating over-privileged tool selection in LLM agents. arXiv preprint arXiv:2606.20023, 2026. · arXiv
- Qiuyang Zhan, Rui Zhang, Sheng Guo, Lepeng Zhao, and Zhuotao Liu. When memory becomes authority: Benchmarking authority collapse at the memory consolidation boundary. arXiv preprint arXiv:2608.01679, 2026. · arXiv
- David Mellafe Zuvic. Capability gates are not authorization: Confused-deputy failures in LLM agent frameworks. arXiv preprint arXiv:2606.28679, 2026. · arXiv
Cited by
Sorted by citations
Zhu, G., & Wang, C. (2026) · arXiv · doi:10.48550/arxiv.2610.00347
- Authors
- Choi, M., Jeong, S., Choi, S., & Lee, S.
- Affiliations
- Seoul National University (KR)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2609.08062
- OpenAlex
- W7212036454
- Cited by
- 0
- References
- 0
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Topics
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Physical Sciences › Computer Science › Artificial Intelligence › Logic, Reasoning, and Knowledge
- Physical Sciences › Computer Science › Information Systems › Digital Rights Management and Security
- Keywords
- language agents, tool use, permission revocation, transitive closure, reachability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
