Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents¶

🕒 Published (v1): 2026-07-11 21:48 UTC · Source: Arxiv · link

Why this paper was selected

Novel commit-time authorization model for LLM agents; directly addresses harness safety boundaries

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

LLM agents routinely commit durable effects (page writes, ticket updates, deploys, branch merges) after the authority evidence that licensed those effects has expired or mutated, even when the visible endpoint looks correct. The paper formalizes this as the commit-time authorization problem, defines four boundary conditions that must hold at the durability boundary, and evaluates COMMITGUARD, a fail-closed boundary monitor. In a 54-task stress suite, 207 of 216 invalidating runs commit after authorization has already been lost.

Problem¶

Existing agent evaluations measure whether the final visible state matches the user's goal (endpoint success), but they do not check whether the authority that licensed that state was still valid when the effect became durable. Authority evidence—DOM snapshots, approval tokens, ETags/version witnesses, branch markers, worker results, shared-memory entries—can be observed early and then carried as derived state (plans, cached targets, staged writes, speculative branch outputs) through many reasoning and tool steps. Any of these witnesses can expire, mutate, or be superseded before commit, creating an unauthorized commit: the effect is externalized after entitlement has already been lost. This is a generalization of TOCTOU that tracks authority propagation through derived state, not just check/use ordering over a single resource.

Method¶

Commit-boundary model. The paper defines a single invariant: derived state retains commit entitlement only while its licensing witness satisfies four conditions at the durability boundary: 1. Freshness — witness is current (not expired, mutated, or revoked) 2. Causal priority — all required predecessor effects completed in order before the commit 3. Effect binding — witness still names the exact concrete target (page instance, ticket id, branch, version) the effect makes durable 4. Commit eligibility — the authorizing path (branch, approval epoch, authorization marker) is still live

Controlled-invalidation suite. A 54-task matrix across three families (18 browser, 18 tool/state, 18 multi-agent), six semantic buckets per family, three tasks per bucket. Each task contributes one clean authorized control plus four unguarded temporal perturbations (callback reorder, delayed tool response, check/use invalidation, expiry/cache skew, late branch cancellation), for 270 rows total. Perturbations preserve the user goal and payload shape while breaking the authority relation before commit.

COMMITGUARD. A fail-closed boundary monitor inserted at protected commit surfaces. It requires the runtime to emit four signals—witness identity/freshness token, dependency resolution evidence, target-binding record, and eligibility marker—and converts any stale durable-effect attempt into a guarded abort rather than a silent unauthorized commit.

Mitigation comparison. Prompt-level caution and single-condition checks (e.g., freshness-only or binding-only guards) are tested as baselines. The paper uses calibrated mitigation probes and a repair-map check (36-task matched subset) to attribute which boundary condition each defense covers.

Key Contributions¶

Formal definition of authorized commit: a durable effect is authorized only if its witness satisfies freshness, causal priority, effect binding, and commit eligibility at the durability boundary
Identification of four boundary checks and the concrete runtime evidence (browser epochs, ETags, approval epochs, branch ids, barrier tokens, memory TTLs, tool-issued capabilities) each requires
A 54-task, 270-row controlled-invalidation benchmark spanning browser, tool/API, and multi-agent commit surfaces with explicit (witness, invalidator, durable-effect) triples per task
Empirical separation of endpoint success from authorized completion under controlled invalidation (262/270 vs. 55/270)
COMMITGUARD: a fail-closed, boundary-time entitlement gate that eliminates unauthorized commits on protected surfaces when required runtime signals are present

Results¶

262/270 (97%) unguarded runs achieve the visible endpoint; only 55/270 (20%) are authorized completions
207/216 invalidating rows commit after the authorization path has already failed
54/54 clean authorized controls remain authorized (zero false positives)
54-run authority-preserving negative-control set produces zero unauthorized commits
Prompt caution and single-condition defenses are insufficient: they repair individual hazard classes but fail to cover all four boundary conditions across the suite
COMMITGUARD (boundary-gate family) blocks stale durable-effect attempts on all protected commit surfaces when required runtime signals are emitted; enforcement converts unauthorized commits to guarded aborts

Limitations¶

Rates are stress-test measurements under controlled invalidation, not deployment prevalence estimates; real-world rates are unknown
COMMITGUARD depends on runtimes emitting all four required signals; if any signal is absent (Table 4), the monitor is blind to the corresponding hazard class
The 54-task library is a systems stress test derived from existing benchmarks, not a random sample of production workflows; coverage of the (witness × invalidator × durable-effect) space is deliberately incomplete
Hidden state that the runtime never records remains outside the model's scope
Host compromise, forged monitor evidence, and model-weight compromise are explicitly out of scope
The 12-task external-workflow panel and 18-task route/model panel are diagnostics rather than primary behavioral evidence; generalization beyond the main matrix is unquantified

Relevance to Harnesses / Meta-Harnesses¶

Agent harnesses and orchestration runtimes are the layer that must emit (or fail to emit) the four boundary signals COMMITGUARD depends on—browser epochs, barrier tokens, branch ids, approval epochs—making this paper a direct design specification for what a secure harness must instrument. The paper demonstrates that harness-level endpoint-success metrics (the standard pass/fail used in virtually all agent benchmarks) are an unsound security proxy, which has implications for how meta-harnesses should aggregate and report results from sub-agents operating with temporary authority. COMMITGUARD functions as a harness-inserted monitor at protected commit surfaces, showing that security properties in multi-step agentic pipelines must be enforced at the orchestration/harness layer rather than delegated to the agent model itself. The multi-agent family of the benchmark (delegated workers, shared memory, speculative branch outputs) maps directly onto how modern meta-harnesses compose sub-agent results before committing their side effects.