Agent Authority Must Survive Change, Contain Data, and Preserve Useful Work

Three verified papers sharpen the control problem for long-lived, tool-using agents. One formalizes when an existing authorization should survive changes to an agent, its tools, delegation structure, or task phase. A second proposes information-flow controls that isolate untrusted inspection in a child trajectory and return only a bounded derivative to the parent context. A third shows why terminal policy outcomes alone are insufficient for evaluating containment: systems with the same zero-harm endpoint can differ substantially in internal propagation and completion of authorized work.

The sources do not establish production-ready governance. The authorization paper is a formal model without an empirical deployment study. The information-flow results come from synthetic scenarios and depend on declared contracts, trusted sanitizers, and a bounded trusted computing base. The containment benchmark is synthetic and single-model, and its strongest policy result assumes a correct structured authorization ledger.

Authorization should be bound to state, not session identity

Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents (opens in a new tab) asks whether a grant remains valid after the authorized agent or its operating context changes. The paper treats the relevant principal as the model plus its harness: instructions, memory, tools, skills, hooks, delegation interfaces, task phase, and enforcement state.

Its model separates two controls. A transition envelope determines which mutations an existing grant may survive. An immutable effect ceiling bounds all authority that can become active under that grant. Authority may contract freely beneath the ceiling and expand only when specified evidence conditions hold, but runtime evidence cannot move the ceiling itself. Crossing the transition envelope suspends the grant even when the requested effects remain inside the original bound.

The authors organize authorization-relevant changes into six classes: control state, capability, delegation, task or phase, trust context, and enforcement. This distinction matters because an authorization can become stale without a tool-manifest change. Moving from drafting to sending, testing to pushing, or diagnosis to remediation can alter consequences while the underlying agent and tool inventory remain unchanged.

The formal non-amplification result requires complete mediation, a sound abstraction of requested and realized effects, attenuating delegation, and an external monitor that the agent cannot modify. It bounds protected effects; it does not prove that an action serves the user’s intent, that the current principal remains acceptable, or that confidential information cannot flow between separately permitted effects.

The paper is an arXiv v1 preprint submitted July 26, 2026. It does not measure how often authorization drift occurs, how frequently benign changes would trigger suspension, or how much reauthorization burden the model creates. Choosing the initial ceiling also remains a policy problem: a ceiling set too high weakens the protection, while one set too low interrupts useful work.

The durable signal is that session continuity should not imply authorization continuity. Persistent memory, a new tool, a delegated subagent, a task-phase change, or weakened enforcement can each require authority to be recomputed or the grant to be suspended.

Untrusted inspection needs a bounded return path

Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents (opens in a new tab) presents APPA, an information-flow-control framework for agents working across mixed-trust and mixed-confidentiality data. Before acquisition, APPA evaluates whether reading a source would lower the current security label or violate prerequisites. It can then produce an explicit remedy plan rather than allowing the model to improvise around a policy failure.

For untrusted inspection, APPA creates a label-seeded child trajectory. The child absorbs the lower-trust context while the parent remains unchanged. A trusted sanitizer may return a bounded derivative to the parent, subject to recipient and release constraints. The paper formalizes parent-label preservation and confinement at merge.

The authors evaluate APPA on a synthetic, multi-turn tool-chaining benchmark across four models. Open baselines recorded attack-success rates of 31% to 50%, while APPA configurations recorded 0% to 7%. On three of the four evaluated models, branching recovered part of the utility lost under taint tracking without forks. These are source-reported results from controlled scenarios, not production attack rates.

The limitations are material. APPA is only as complete as the contracts it evaluates. The paper identifies a laundering path caused by an undeclared write-side contract. Sanitizer correctness is inside the trusted computing base. Context branching isolates trajectories but does not roll back side effects already committed by a child branch, including external network egress. The evaluation uses synthetic scenarios designed to exercise APPA’s primitives and does not establish performance across ambiguous, long-running enterprise workloads.

The architectural signal is that untrusted content should not enter a high-authority context merely because an agent needs to inspect it. Inspection can occur in a scoped branch, but the return path, permitted derivative, destination, and external side effects must be governed structurally.

Containment cannot be reduced to the final outcome

ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents (opens in a new tab) evaluates what happens after an agent encounters injected content. Version 2 was submitted July 28, 2026, inside the strict publication window. The paper separates four dimensions that terminal success or failure labels can collapse: endpoint policy compliance, logged propagation, recovery instrumentation, and completion of authorized structured actions.

In a pre-specified study of 17,640 rollouts using Qwen2.5-7B-Instruct, all 600 matched active-tainted comparisons between taint-only and intent-aware enforcement produced the same zero committed-harm outcome. Despite that identical endpoint, 73.5% differed in logged trajectory or utility. Taint-only enforcement completed 0.1642 of authorized tainted workflows. A trusted-ledger policy raised completion to 0.8567, while a strong tool-boundary baseline reached 0.9233 under the same observed endpoint-policy outcome.

The result does not show that one policy is universally safer. It shows that a zero-harm endpoint is not a sufficient description of containment. A system may block harmful effects while allowing broad internal propagation, or it may preserve safety by refusing most legitimate work. Evidence about propagation, recovery, and authorized utility is therefore necessary to distinguish operationally different systems.

The benchmark is synthetic and uses one model. Logged-spread rankings change with evidence-stage composition and denominator choice. The trusted-ledger result also assumes the structured authorization ledger is correct. These limits make the paper an evaluation-method signal rather than a general production-performance claim.

For governed agents, evidence should capture not only whether a prohibited effect occurred, but where untrusted influence travelled, which control intervened, what recovery occurred, and whether the authorized task remained achievable.

Keelbase Signal assessment

Together, the three papers support three distinct governance boundaries:

• An authorization-continuity boundary should decide whether an existing grant survives changes to agent state, delegation, task phase, or enforcement.
• An information-flow boundary should determine how untrusted or lower-trust content is inspected and what may return to a higher-authority context.
• An evidence boundary should record propagation, intervention, recovery, and authorized utility instead of reducing containment to a final pass or fail.

For Keelbase, the implications are structural. Vessel authority should remain anchored outside mutable agent state. A specialist or delegated agent should not inherit ambient authority merely because it descends from an authorized session. Untrusted inspection should occur in a constrained execution context with explicit return rules, while the AnchorLog should preserve the trace needed to distinguish prevented harm from useful, well-contained execution.

The sources do not demonstrate runtime behavioral safety, universal non-interference, or a production-complete authorization system. Their combined value is narrower and more durable: authority must be re-evaluated as agents change, data must be confined as it moves, and containment must be measured across the execution trace rather than inferred from the endpoint alone.