AID-Guard Revalidates Agent Authorization at Commit Time, Surviving 210 Stripe Contract Trials and 10 Crash-Recovery Schedules Without Duplicate Effects
The paper's premise is that agent authorization usually ends at admission while provider state, delivery, retry and recovery keep evolving, so a request can change before commit or a lost response can cause a replacement call to create a second real-world effect from one approval. AID-Guard revalidates the approved request and provider state at commit, holds a single reservation under ambiguity, and permits release or exactly one successor only after a terminal result or certified no-effect with a delivery fence. The Python/SQLite prototype handled 13 live mutations in a loopback MCP domain with no unauthorized effects and three linearizable concurrent histories, and across Stripe and Resend it completed 40 terminalize-successor schedules, 30 overlapping races and 10 crash-recovery schedules without duplicate effects, plus 210 Stripe provider-contract trials matching predeclared outcomes.
↳ Follow the thread