Authorization drift: every MCP tool call is individually legal while the sequence escapes the session's boundary

arXiv 2609.23498·high signalXBlueskyLinkedInCopy link

Runtime Authorization Consistency Checking names a failure that per-call checks structurally cannot see — each step is locally admissible, but the accumulated workflow exceeds the authorization granted for the session. RAC treats authorization as runtime state carried by accepted steps, reconstructs a trusted authorization event from controller-observed metadata at the tool-call boundary, and admits a call only if it is no more permissive than the basis inherited through accepted lineage; rejected steps are dropped from lineage so later continuations cannot draw on them. On the 1,248-workflow TraceBench suite RAC had zero missed blocks where the strongest Static+History baseline missed 509 of 1,008, reached 92.8% block recall on blind LLM-generated plans against 68.8%, and ran at sub-millisecond p99.