CoChat
Sign Up
PreprintCited by 1Access Control and TrustDistributed systems and fault toleranceLogic, programming, and type systems

Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution

Open access
Zhu, Genliang, Wang, Chu·2026·arXiv
DOI 10.48550/arxiv.2609.21284arXiv 2609.21284
Open this paper in CoChat — free accountOpen PDF

Abstract

Long-running AI agents outlive initiating processes through credentials, delegated tasks, queues, callbacks, reservations, and provider-side operations. Cancellation, process exit, and credential revocation neither close every pre-cut carrier nor distinguish independently authorized shared work. We define root-scoped authorization quiescence: for each manifested sink, a certificate accounts for every cut-relevant acceptance under the retired root-epoch atom that precedes its local fence and excludes protected acceptance under that atom after the fence, while permitting exact rebind to a current, independently sufficient support. The root-scoped quiescence protocol linearizes a root cut, fences old-root expansion and protected sinks, represents alternative and conjunctive authority as antichains of minimal sufficient root sets, and composes provider-frontier certificates into a cutset over registered old-root paths. Exact channel-token accounting reconciles transfers; missing or conflicting evidence remains indeterminate. Under stated assumptions, we prove post-cut issuer non-expansion, support-sound projection, compositional soundness under exact channel conservation, independent-support preservation, merge-order independence, and crash/replay stability. A provider-free late-effect test suite matches 17/17 registered outcomes. Two cancellation-only and one cut-only execution accept the same class of already scheduled late effect; two cut-plus-fence executions, one restart, and one stale-process execution reject it. A separately implemented checker verifies 17/17 traces and rejects 44/44 consistently rehashed semantic regressions. The certificate establishes root-relative authorization quiescence within its bound manifest and configuration, not global idleness, rollback, or business completion.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2609.21284

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Root-scoped authorization quiescence accounts for every manifested pre-cut carrier under a retired root epoch and composes provider-frontier certificates while preserving independently sufficient support.

    “Root-scoped authorization quiescence additionally accounts for every manifested pre-cut carrier under a retired root epoch and composes provider-frontier certificates while preserving independently sufficient support [42].”

    From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [42]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 32

  1. Lujo Bauer, Scott Garriss, and Michael K. Reiter. 2005. Distributed Proving in Access-Control Systems. In 2005 IEEE Symposium on Security and Privacy. IEEE Computer Society, Oakland, CA, USA, 81-95. doi:10.1109/SP.2005.9 · DOI
  2. Ajay Chander, Drew Dean, and John C. Mitchell. 2001. A State-Transition Model of Trust Management and Access Control. In Proceedings of the 14th IEEE Computer Security Foundations Workshop. IEEE Computer Society, Cape Breton, Nova Scotia, Canada, 27-43. doi:10.1109/CSFW.2001.930134 · DOI
  3. K. Mani Chandy and Leslie Lamport. 1985. Distributed Snapshots: Determining Global States of Distributed Systems. ACM Transactions on Computer Systems 3, 1 (Feb. 1985), 63-75. doi:10.1145/214451.214456 · DOI
  4. Moonwon Choi, Seokho Jeong, and Seunggeun Lee. 2026. ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation? arXiv:2609.08062 [cs.AI] https://arxiv.org/abs/2609.08062 Version 1, submitted 8 September 2026. · arXiv
  5. Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. 2024. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. In Advances in Neural Information Processing Systems, Vol. 37. Curran Associates, Inc., Vancouver, BC, Canada, 82895-82920. doi:10.52202/079017-2636 · DOI
  6. Saurabh Deochake. 2026. Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms. arXiv:2605.20704 [cs.CR] https://arxiv.org/abs/2605.20704 Version 1, submitted 20 May 2026. · arXiv
  7. Edsger W. Dijkstra and Carel S. Scholten. 1980. Termination Detection for Diffusing Computations. Inform. Process. Lett. 11, 1 (1980), 1-4. doi:10.1016/0020-0190(80)90021-6 · DOI
  8. Hector Garcia-Molina and Kenneth Salem. 1987. Sagas. In Proceedings of the 1987 ACM SIGMOD International Conference on Management of Data. Association for Computing Machinery, San Francisco, CA, USA, 249-259. doi:10.1145/ 38713.38742 · DOI
  9. Cary G. Gray and David R. Cheriton. 1989. Leases: An Efficient Fault-Tolerant Mechanism for Distributed File Cache Consistency. In Proceedings of the 12th ACM Symposium on Operating Systems Principles. Association for Computing Machinery, Litchfield Park, AZ, USA, 202-210. doi:10.1145/74850.74870 · DOI · Paper page
  10. Åsa Hagström, Sushil Jajodia, Francesco Parisi-Presicce, and Duminda Wijesekera. 2001. Revocations-A Classification. In Proceedings of the 14th IEEE Computer Security Foundations Workshop. IEEE Computer Society, Cape Breton, Nova Scotia, Canada, 44-58. doi:10.1109/CSFW.2001.930135 · DOI · Paper page
  11. Sajjad Khan. 2026. Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives. arXiv:2607.14166 [cs.SE] https://arxiv.org/abs/2607.14166 Version 3, revised 8 August 2026. · arXiv
  12. Ninghui Li, Benjamin N. Grosof, and Joan Feigenbaum. 2003. Delegation Logic: A Logic-Based Approach to Distributed Authorization. ACM Transactions on Information and System Security 6, 1 (Feb. 2003), 128-171. doi:10.1145/605434. 605438 · DOI
  13. Lifei Liu, Haoran Yu, and Xiaochong Jiang. 2026. VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows. arXiv:2608.30091 [cs.AI] https://arxiv.org/abs/2608.30091 Version 1, submitted 30 August 2026. · arXiv
  14. Torsten Lodderstedt, Stefanie Dronia, and Marius Scurtescu. 2013. OAuth 2.0 Token Revocation. RFC 7009. Internet Engineering Task Force. doi:10.17487/RFC7009 · DOI
  15. Friedemann Mattern. 1987. Algorithms for Distributed Termination Detection. Distributed Computing 2, 3 (1987), 161-175. doi:10.1007/BF01782776 · DOI
  16. Xabier Muruaga. 2026. Bounded Agents: Delegation Security for Multi-Agent AI Systems. arXiv:2608.15888 [cs.AI] https://arxiv.org/abs/2608.15888 Version 1, submitted 16 August 2026. · arXiv
  17. Jaehong Park and Ravi Sandhu. 2004. The UCONABC Usage Control Model. ACM Transactions on Information and System Security 7, 1 (Feb. 2004), 128-174. doi:10.1145/984334.984339 · DOI
  18. Suliu Qin, Haomin Zhuang, Yujun Zhou, Yufei Han, and Xiangliang Zhang. 2026. AIRGuard: Guarding Agent Actions with Runtime Authority Control. arXiv:2605.28914 [cs.CR] https://arxiv.org/abs/2605.28914 Version 1, submitted 27 May 2026. · arXiv
  19. Justin Richer. 2015. OAuth 2.0 Token Introspection. RFC 7662. Internet Engineering Task Force. doi:10.17487/RFC7662 · DOI
  20. Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. 2020. Zero Trust Architecture. Special Publication 800-207. National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-207 · DOI · Paper page
  21. Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris Maddison, and Tatsunori Hashimoto. 2024. Identifying the Risks of LM Agents with an LM-Emulated Sandbox. In International Conference on Learning Representations. OpenReview.net, Vienna, Austria, 27031-27098. https://proceedings. iclr.cc/paper_files/paper/2024/hash/7274ed909a312d4d869cc328ad1c5f04-Abstract-Conference.html
  22. Jerome H. Saltzer and Michael D. Schroeder. 1975. The Protection of Information in Computer Systems. Proc. IEEE 63, 9 (Sept. 1975), 1278-1308. doi:10.1109/PROC.1975.9939 · DOI · Paper page
  23. Igor Santos-Grueiro. 2026. Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents. arXiv:2606.22504 [cs.CR] https://arxiv.org/abs/2606.22504v1 Version 1, submitted 21 June 2026. · arXiv
  24. Igor Santos-Grueiro. 2026. Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents. arXiv:2607.10487 [cs.CR] https://arxiv.org/abs/2607.10487v1 Version 1, submitted 11 July 2026. · arXiv
  25. Igor Santos-Grueiro. 2026. When Does Authorization End? Effect Closure at Provider Boundaries. arXiv:2609.02866 [cs.CR] https://arxiv.org/abs/2609.02866 Version 1, submitted 2 September 2026. · arXiv
  26. Yingzhe Tong, Leyu Dai, and Songhui Guo. 2026. AID-Guard: Stateful Authorization for Delegated Agent Effects. arXiv:2608.21159 [cs.CR] https://arxiv.org/abs/2608.21159v1 Version 1, submitted 21 August 2026. · arXiv
  27. Jacques Wainer, Akhil Kumar, and Paulo Barthelmess. 2007. DW-RBAC: A Formal Security Model of Delegation and Revocation in Workflow Systems. Information Systems 32, 3 (May 2007), 365-384. doi:10.1016/j.is.2005.11.008 · DOI
  28. Baoyuan Wu, Qingshan Liu, Adel Bibi, Irwin King, and Siwei Lyu. 2026. The Authorization-Execution Gap Is a Major Safety and Security Problem in Open-World Agents. arXiv:2605.11003 [cs.CR] https://arxiv.org/abs/2605. 11003v1 Version 1, submitted 10 May 2026. · arXiv
  29. Mengting Wu, Lin Wang, Yong Zhang, and Jiang Deng. 2026. From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions. arXiv:2609.11596 [cs.CR] https://arxiv.org/abs/2609.11596 Version 1, submitted 10 September 2026. · arXiv
  30. Longhua Zhang, Gail-Joon Ahn, and Bei-Tseng Chu. 2003. A Rule-Based Framework for Role-Based Delegation and Revocation. ACM Transactions on Information and System Security 6, 3 (Aug. 2003), 404-441. doi:10.1145/937527. 937530 · DOI
  31. Zhaoxi Zhang and Xiaomei Zhang. 2026. Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents. arXiv:2607.23586 [cs.AI] https://arxiv.org/abs/2607.23586 Version 1, submitted 26 July 2026. · arXiv
  32. Chris Zheng and Geng Yang. 2026. CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls. arXiv:2609.05269 [cs.CR] https://arxiv.org/abs/2609.05269 Version 1, submitted 4 September 2026. · arXiv

Cited by

Sorted by citations

Authors
Zhu, G., & Wang, C.
Affiliations
  • Georgia Institute of Technology (US)
  • University of Illinois Urbana-Champaign (US)
Corresponding author
Zhu, Genliang
ORCID
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
1556-5068 (ISSN-L)
DOI
10.48550/arxiv.2609.21284
arXiv
2609.21284
OpenAlex
W7213957426
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • SSRN Electronic Journal (acceptedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Computer Networks and Communications › Distributed systems and fault tolerance
  • Physical Sciences › Computer Science › Artificial Intelligence › Logic, programming, and type systems
Keywords
authorization revocation, delegation, asynchronous execution, antichains, cancellation, credential revocation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review