Identity, Authorization, and Runtime Execution Binding Are Three Separate Problems Current Agent Security Frameworks Conflate

arXiv 2607.21325·medium signal

Llambí-Morillas and Fernández-Fernández formalize Cryptographically Verifiable Agent Authorization (CVA) as a relation R_CVA that jointly binds an agent principal, a concrete authorization request, an execution context, and policy satisfaction while keeping private authorization attributes confidential. They define candidate security properties — authorization soundness, principal binding, request binding, policy binding, replay resistance — and ship an executable zero-knowledge proof of concept over a Groth16 zk-SNARK construction. Their central claim is structural: existing agentic security frameworks do not explicitly separate identity binding from authorization-request binding from runtime execution binding, and that conflation is the open problem.