Cryptographically Verifiable Agent Authorization: identity, authorization and runtime execution binding are three problems, not one.

Llambí-Morillas and Fernández-Fernández formalize CVA as a relation jointly binding an agent principal, a concrete authorization request, an execution context, and policy satisfaction while keeping private authorization attributes confidential. They define authorization soundness, principal binding, request binding, policy binding and replay resistance, and ship an executable zero-knowledge proof of concept over Groth16. Their central claim is structural: existing agentic security frameworks don't explicitly separate identity binding from authorization-request binding from runtime execution binding, and that conflation is the open problem. If you're building agent auth, that three-way split is the design constraint.