Authorization state complexity affects language agent permission decisions
ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?
Artificial IntelligenceCryptography and Security
Summary
When AI language agents use tools that require permissions, figuring out which prior permissions and revocations they must remember is tricky. The authors show that two seemingly identical permission setups can lead to very different decisions after a permission is revoked. They define a new way to measure what information about past permissions needs to be kept to make correct decisions. They tested this with language models and found that some ways of summarizing past permissions fail, while including authenticated records helped models make better decisions.
What this means in practice
- •For software security teams: Improve language-agent-based system design to track authorization history precisely for correct permission revocation handling.
- •For ai chatbot developers: Enhance chatbot permission management by incorporating authenticated authorization state summaries to prevent unauthorized actions after delegation changes.
Authors
Moonwon Choi, Seokho Jeong, Seunggeun Lee
Abstract
Tool-using language agents can delegate and revoke permissions while acting through external services. We show that two authorization histories can have identical current permissions and identical all-pairs reachability yet require opposite decisions after the same direct-edge revocation. We formalize the information needed to preserve such distinctions as a residual authorization state. We prove that exponentially many future-distinct states can share one fixed transitive closure, and give exact or tight asymptotic bounds on the state required by an exact monitor as delegation redundancy varies. ResidualAuth compiles these constructions into paired language-agent episodes. Across four open-weight models, a fixed 256-token summary solved 0-2/16 pairs, sham reads solved 0/16, and authenticated current-query reads solved 15-16/16. In a separate held-out online-memory diagnostic, exact ledger serializations fit all 128 four-coordinate pairs at both 768 and 1,024 tokens. At either cap, factually supported model-written memories sufficient for every prespecified continuation solved at most 1/128 pairs per model. A hard gate reduced eight observed unauthorized effects to zero without changing the preceding attempts. These results distinguish required authorization state, usable decision information, online state maintenance, and effect mediation.