Researchers Fix an Immutable Ceiling on AI Agent Permissions

A new paper argues AI agent permissions shouldn't assume the agent you approved is still the agent running your tasks, per arXiv 2607.23586.

The paper identifies six ways an agent's behavior can drift after a grant. Current permission systems miss all six, whether the agent picks up new tools, rewrites its own workflow, or delegates work to other agents.

Their fix is a state-bound model. At the moment authority is granted, the system locks in two things. One is a transition envelope for how the agent's state can evolve. The other is an effect ceiling on what it's allowed to do, and that ceiling doesn't move afterward. Below it, authority can contract on its own as the agent specializes. It only expands back when the system has specific evidence for it, not just a request from the agent.

The authors prove this holds under four conditions. Every agent action has to pass through the system, what they call complete mediation. The system's abstraction of what an action does can't undercount the real effect. Delegation can only narrow authority, never widen it. And the monitor enforcing all this can't be fooled. If all four hold, no sequence of changes to the agent, however long-running, can push its effects past the ceiling set at the start.

That's the whole guarantee: four conditions, proven mathematically, none of them a description of a system that's already running. Anyone building agents that pick up tools and hand off tasks over time has a spec for what to check. It's not a tool they can install yet.