EffectBound Finds Authorization Revocation Incomplete in GitHub, Kubernetes, NATS and Kafka

arXiv 2609.02866·high signalXBlueskyLinkedInCopy link

EffectBound formalizes 'policy-relative effect closure' — whether revoking a grant actually removes every path by which already-authorized work can still cause an effect — and reduces the question to finite control with hidden state, returning either a strategy, an impossibility certificate, or no verdict. Across four real systems closure fails in three distinct ways: the interface lacks a needed control, clean visible state hides active work, or the model stops before the effect frontier. A controlled run confirmed the GitHub tool cannot bind a merge to the reviewed commit and may merge a different one; NATS reports zero stored and zero pending messages while dispatched work can still publish downstream; and in Kafka every fixed-set broker had applied the revocation yet an earlier authorized request could still append.