Summary
Managing permissions for AI agents that use external tools is tricky because simply knowing what permissions are active isn’t always enough to decide what to do when permissions are revoked. The researchers show that two situations can look the same but still require different actions after a permission change. They define the extra information, called residual authorization state, that agents must keep to handle these cases properly. Their experiments demonstrate that simple permission summaries often fail, while more detailed state tracking can prevent unauthorized actions. This work clarifies what information language agents need to keep to manage access safely and effectively.
authorizationdelegationrevocationlanguage agentstransitive closureauthorization statepermission managementonline memorytool usageeffect mediation
Authors
Moonwon Choi, Seokho Jeong, Seunggeun Lee
Abstract
Tool-using language agents can delegate and revoke permissions while acting through external services. We show that two authorization histories can have identical current permissions and identical all-pairs reachability yet require opposite decisions after the same direct-edge revocation. We formalize the information needed to preserve such distinctions as a residual authorization state. We prove that exponentially many future-distinct states can share one fixed transitive closure, and give exact or tight asymptotic bounds on the state required by an exact monitor as delegation redundancy varies. ResidualAuth compiles these constructions into paired language-agent episodes. Across four open-weight models, a fixed 256-token summary solved 0-2/16 pairs, sham reads solved 0/16, and authenticated current-query reads solved 15-16/16. In a separate held-out online-memory diagnostic, exact ledger serializations fit all 128 four-coordinate pairs at both 768 and 1,024 tokens. At either cap, factually supported model-written memories sufficient for every prespecified continuation solved at most 1/128 pairs per model. A hard gate reduced eight observed unauthorized effects to zero without changing the preceding attempts. These results distinguish required authorization state, usable decision information, online state maintenance, and effect mediation.