The paper introduces "authorization succession," a framework that preserves authority across self‑modifying AI agent populations that can replace, fork, or roll back. It defines a protocol binding each generation to a manifest, root, unique parent, lineage, and population sequence, and establishes invariants that control root‑lifetime consumption and population exposure. The authors prove properties such as population‑safe succession, fork conservation, and rollback non‑reminting, and validate the approach with an executable evaluation covering 32 decisions and external adapters for two mutation systems.
arXiv:2609.21284v1 Announce Type: cross Abstract: Long-running AI agents outlive initiating processes through credentials, delegated tasks, queues, callbacks, reservations, and provider-side operatio...
The paper introduces a fault‑tolerant budget conservation framework for distributed multi‑agent delegation, where budgets are represented as exclusive escrow credits that traverse a delegation DAG. It details how each branch converts credit into a reservation tied to lineage, epoch, and idempotency, persists a signed dispatch permit, and ensures that uncertain effects remain charged until settlement or retirement. The authors prove properties such as ownership partition, ledger conservation, and at‑most‑once settlement, and validate the mechanism through TLA+ checks, a JavaScript explorer, and crash‑injected SQLite experiments.
arXiv:2608. 11632v1 Announce Type: cross Abstract: Persistent AI agents accumulate versioned state across long horizons, but storage retention alone does not identify authoritative state.
arXiv:2608.21159v1 Announce Type: cross Abstract: Tool-using AI agents turn delegated tasks into provider effects, yet authorization often ends at admission while provider state, delivery, retry, and...
arXiv:2607. 23586v1 Announce Type: new Abstract: Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases.
arXiv:2608.30091v1 Announce Type: new Abstract: Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation API...
arXiv:2609. 00546v1 Announce Type: cross Abstract: Agent systems are commonly described by the model and harness that currently produce their behavior.
arXiv:2607. 10487v1 Announce Type: cross Abstract: LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result.
arXiv:2606. 22504v1 Announce Type: cross Abstract: Coding agents often receive broad tool access for an entire task, even when a resource is needed only for one subgoal.
ClosureBound is a reference monitor that enforces authorization boundaries for agent skills by binding each grant to an exact dependency closure, effect ceiling, purpose, validity, and epochs. It resolves typed graph nodes, normalizes operations into an external‑effect IR, and admits actions only when a joint witness satisfies all bounds, ensuring metadata non‑authority, closure determinism, and other security properties. Empirical evaluation on 549 public skills shows many lack proper dependency declarations, underscoring the need for conservative closure discovery and broader runtime validation.
arXiv:2609.14744v2 Announce Type: replace Abstract: By acquiring compute, credentials, accounts, services, and other agents, autonomous AI agents can introduce new authority into a task. Payment, bud...
The paper introduces the concept of Cognitive Serializability for autonomous AI agents, ensuring that mutations derived from dynamic inputs—such as database reads, evidence, policy, beliefs, and delegated authority—are committed in a serial, logically consistent order. It presents a framework called Trusted Cognitive Transaction (TCT) that combines immutable executable definitions, sealed envelopes, guard-first commits, and receipt-driven reconciliation to enforce serializability and prevent anomalies. Experimental results show that the prototype implementation incurs minimal overhead while eliminating injected anomalies.