An AI agent can be authorized at planning time—and still be unsafe at execution time
Imagine an autonomous agent receives permission to perform an action. It collects evidence, plans its steps, and prepares an external write.
Before that write occurs, something changes: a permission is revoked, the target resource changes, or the evidence used to admit the action is no longer applicable.
Should the original approval still be enough?
My technical preprint, Authority-Bound Execution for Agentic Systems: A Formal Architecture for Provenance-Validated Admission, Revocation Fencing, and Recoverable Effects (CC-RP-001, v0.5), investigates this problem as one of authority, provenance, time, and recoverability.
Read the paper: Zenodo DOI: 10.5281/zenodo.23823408
Author: Christian Serrano, Caivra Tech LLC
Preprint version: v0.5, October 30, 2026
Status: Public theoretical research preprint, not independently peer reviewed.
Why a valid approval can become insufficient
An action can appear authorized when planned yet be inadmissible when executed.
For example:
- A security review approves a change for one repository revision, but the underlying code changes afterward.
- A capability is granted with a limited scope, but the proposed effect targets a resource outside that scope.
- A delegated permission is revoked while a job is waiting in a queue.
- A network operation times out after the remote system may already have committed the effect.
Each example requires more than asking whether an AI's initial request was plausible. It requires checking which authority applies to which exact action, based on which evidence, at what point in the workflow, and how outcomes are recovered.
The paper proposes an architectural vocabulary for reasoning about these boundaries.
1. Provenance-validated admission
A provenance record is not automatically evidence that a proposed operation is admissible.
Suppose a test result was produced for revision A. An agent now wants to mutate revision B. The fact that a test passed is real historical evidence—but whether it applies to the new target is a separate question.
The proposed approach treats admission as dependent on evidence that is:
- Authentic: Who or what produced it?
- Applicable: Does it refer to this operation, resource, revision, and context?
- Fresh enough: Has a relevant dependency changed since it was produced?
- Within scope: Does the evidence support this requested decision, rather than a broader claim?
A model-generated explanation cannot resolve these questions by assertion alone. Admission must be tied to the relevant authoritative mechanisms.
2. Revocation fencing near consequential effects
A common timing problem appears when authorization is checked upstream, but execution happens later.
Conceptually:
Agent proposes action
|
Resolve applicable authority
|
Validate evidence and admission conditions
|
Prepare candidate operation
|
Check revocation/freshness at the effect boundary
|
Commit permitted effect OR refuse/hold
The important idea is that an earlier permission check should not automatically survive a material authority change.
A design intended to enforce this property needs a reliable relationship between the authoritative revocation state and the consequential effect boundary. Otherwise, a race between a revocation and an operation can leave the system acting on stale authority.
The manuscript explores a proposed fencing approach and related conditional safety properties. The challenge is to show, under explicit assumptions, that a relevant revocation cannot be bypassed by queued work, alternate execution routes, or stale authorizations.
3. Recoverable effects and unknown outcomes
Now consider a different failure.
An agent asks a remote service to create a resource. The request times out. The agent cannot tell whether the remote operation committed.
Blindly repeating the request may create duplicates. Assuming it failed may be wrong. Assuming it succeeded may also be wrong.
Recoverable execution needs to distinguish:
- An effect that is known not to have happened.
- An effect that is known to have happened.
- An effect whose outcome remains unknown.
That third state matters. The research discusses durable reconciliation of uncertain outcomes rather than treating every timeout as a safe opportunity to retry.
Depending on the external service, a practical strategy may involve stable operation identifiers, idempotency support, state queries, or controlled recovery workflows. No single mechanism works universally across all APIs.
4. Authority is not the same as trust, evidence, or execution
The paper emphasizes boundaries that are often collapsed in agent discussions:
- Intent: What a caller or agent wants.
- Authority: Who can permit the consequential action.
- Admission: Whether the specific candidate satisfies applicable conditions.
- Capability: What bounded operation has actually been granted.
- Execution: What effect was attempted.
- Evidence: What can be substantiated about that attempt.
- Reconciliation: How uncertain or partial outcomes are resolved.
Keeping these concepts distinct helps reveal where systems otherwise confuse a caller's claim with a governing decision or a successful tool call with an approved final state.
A research agenda—not a declaration of proof
The preprint proposes an architecture, conditional safety propositions, and a falsifiable evaluation plan.
It does not report completed machine-checked proofs, controlled comparative benchmarks, independent peer review, or production validation. The proposed properties still need rigorous implementations, explicit threat models, failure-injection tests, and comparative evaluation.
Useful negative tests include:
- Revocation committed immediately before effect-time checks.
- Revocation racing with execution.
- Replayed or duplicated requests.
- Evidence that is genuine but stale or inapplicable.
- Alternate entry points that bypass expected checks.
- Remote timeouts after a possibly committed effect.
- Process restart during unresolved reconciliation.
A design should be assessed by the failures it can rule out under specified assumptions—not just by successful demonstration paths.
Why publish this work?
Agent tooling is rapidly increasing the number of systems capable of making consequential external changes. The difficult engineering problem is not simply generating better decisions; it is preserving valid decision authority across the full path from proposal to effect and recovery.
This preprint contributes a proposed framework and an explicit set of questions that can be examined, challenged, and experimentally tested.
Read and cite
Paper: Authority-Bound Execution for Agentic Systems: A Formal Architecture for Provenance-Validated Admission, Revocation Fencing, and Recoverable Effects
Identifier: CC-RP-001
Version: v0.5
Published: October 30, 2026
Citation: Serrano, C. (2026). Authority-Bound Execution for Agentic Systems: A Formal Architecture for Provenance-Validated Admission, Revocation Fencing, and Recoverable Effects (Version 0.5). Zenodo. https://doi.org/10.5281/zenodo.23823408
Research integrity note: This is an independent explanatory article about a theoretical preprint, not an announcement of completed verification or deployment. The Zenodo version DOI identifies the authoritative archival manuscript. The related CEOS repository is contextual material, not the source repository for this distinct CaivraCore preprint.
Top comments (0)