AI summaryⓘ
The authors explain a problem where language model agents using tools might reuse authorization tokens in unintended ways during retries and task delegations, causing extra executions beyond what was originally allowed. They call this problem semantic replay, which simple token tracking can’t stop without keeping a detailed, unchanging record of actions and permissions. To fix this, they propose CapLease, a system that tracks authorization carefully by requiring clear user confirmations and step-by-step control over issuing and using tokens. Their experiments show that CapLease prevents repeated or duplicated actions better than usual token methods. Overall, the authors emphasize that durable, stateful authorization tracking is key to stopping these replay problems in agent systems.
tool-using language modelsauthorization tokenssemantic replaytoken consumptionCapLeasetransactional statereplanning and retryagent executiondurable stateidempotence
Authors
Jinghan Xu, Longze Fan, Zeyuan Wang, Xinjin Li, Hankai Liu
Abstract
Tool-using large language model agents frequently replan, retry failed operations, delegate tasks, and resume after crashes. These behaviors can cause one user authorization to be requested and executed multiple times under freshly issued token identifiers, even when each individual token is single-use. We call this failure semantic replay: exceeding the execution budget of a token-independent authorization instance rather than merely reusing an old token identifier. We show that identifier-local token consumption cannot prevent fresh reissuance unless the issuer retains monotonic durable state over the authorized action, confirmation event, and remaining execution budget. We introduce CapLease, an authorization-consumption layer that follows proposal- and authority-level defenses, binds an authenticated user confirmation to a canonical action, and enforces transactional Issue-Prepare-Commit transitions. Across LLM-agent replanning, retry, delegation, concurrency, confirmation-replay, and crash-recovery scenarios, identifier-local tokens permit fresh semantic reissuance, whereas CapLease and an equally stateful Server Ledger prevent duplicate admission and, with an idempotent sink, duplicate external effects. Our results identify durable authorization state, rather than token representation alone, as the systems requirement for replay-resistant agent execution.