Agent Approval Laundering: Transitive Effects Beyond the Approved Invocation

arXiv:2609.28586 · cs.CR, cs.SE · Submitted 2026-09-23 · Read on arXiv

cs.CR, cs.SE

Submitted: 2026-09-23

Updated: 2026-09-23

Comments: 19 pages, 9 figures

Project page: https://openid.github.io/authzen

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Trace — 38× in this paper · explained in 2 episodes
• Provenance — 23× in this paper · explained in 3 episodes
• Benchmark — 13× in this paper · explained in 2 episodes
• Accuracy — 8× in this paper · explained in 1 episode
• Network and Distributed System Security Symposium — 4× in this paper
• Agentic AI — 3× in this paper · explained in 1 episode
• Alignment — 3× in this paper · explained in 1 episode
• Verifier — 3× in this paper · explained in 2 episodes
• Actor — 2× in this paper · explained in 3 episodes
• Agent Skills — 2× in this paper · explained in 1 episode
• Agentic AI systems — 2× in this paper · explained in 1 episode
• Calibration — 2× in this paper · explained in 7 episodes
• Error Localization — 2× in this paper · explained in 2 episodes
• Verification — 2× in this paper · explained in 2 episodes
• AI Agents — 1× in this paper · explained in 2 episodes
• Abstraction — 1× in this paper · explained in 1 episode
• Agentic System — 1× in this paper · explained in 2 episodes
• Failure Modes — 1× in this paper · explained in 3 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• Human-in-the-Loop — 1× in this paper · explained in 3 episodes
• Model-Agnostic — 1× in this paper · explained in 2 episodes
• SIGSAC Conference on Computer and Communications Security — 1× in this paper

Sources

• What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents
• The Authorization-Execution Gap Is a Major Safety and Security Problem in Open-World Agents
• Do Coding Agents Understand Least-Privilege Authorization?
• How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement
• Proof-Carrying Agent Actions: Model-Agnostic Runtime Governance for Heterogeneous Agent Systems
• CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems
• ToolGuardian: Declarative Security for AI Agent-Tool Interactions
• Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode
• Reframing LLM Agent Security as an Agent-Human Interaction Problem
• Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI
• Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks
• Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections
• Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs