arXiv preprint ·
Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways
- Published
- Source
- arXiv preprint, posted before peer review
- Original
- Read it at arXiv
- Topics
Abstract
Distributed agent workflows cache delegated authority at tool gateways. Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped. We define C0-C5, a bounded outcome contract spanning issuer commit through effect prevention, and implement it as a persistent monitor over a frozen gateway set, call set, and observation window. A 14-case fault matrix checks conservative classification, sticky violations, restart persistence, and evidence immutability. In a derived audit of its eight semantic cases, treating C3 or C4 as completion produces seven or five false positives, respectively; the bounded C0-C5 verdict produces none. Descriptive scaling covers 1,024 gateways and 10,000 effect vectors. The primary experiment uses the maintained Keycloak 26.7 identity server and measures the contract across two durable receivers, eight physical agent-tool gateways, Filesystem and PostgreSQL effects, and 16 AWS hosts in three availability zones. Normal delivery and recovery commit no effects. Under receiver-selective non-delivery, transport acknowledgment and receiver persistence still succeed, but 112 of 225 calls (49.78%) are admitted, and all 112 effects commit in every treatment block. A separately provisioned execution repeats the result. OPA/Toxiproxy and a live three-role LLM workflow with networked MCP tools reproduce the persisted-but-not-enforced boundary on narrower surfaces. Finally, an unmodified external MCPMark agent executes 60 closed-loop task arms. Normal C4 denies all 31 exposed post-barrier calls and commits no effect; selective C3 allows 344 calls and commits 145 effects across Filesystem and PostgreSQL. Transport success is therefore evidence of progress, not a revocation-completion verdict.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Artificial Intelligence
Accuracy and Uncertainty in Machine Deception Detection (Research White Paper)
Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving
From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agents
When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
Security in LLM-Assisted Coding: A Systematic Literature Review
Get the few papers worth your time in Artificial Intelligence every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.