authorization

The paper introduces SafeWebWorld, a benchmark for evaluating 'safety sufficiency' in web world models, showing that plausible prediction, evidence preservation, and latent authorization recovery are each insufficient to establish robust EXECUTE/ASK/BLOCK authorization decisions.

A study of execution-time reliability in tool-using AI agents that isolates recovery decisions from language-model behavior, evaluating checkpoint state, dispatch authority, external-effect evidence, and reconciliation obligations across 336 histories on LangGraph and Temporal hosts, plus a component study of Arya.ai's InfinityOS.

ANP draft outlines a layered agent identity and authorization model: DID identifies callers, OAuth+CIMD reuses existing account permissions, and VCs handle personal/enterprise delegation with revocation checked at execution time.

Alter (YC S25) launched Alter Vault, a privileged access management and authorization platform that gives AI agents their own scoped credentials, policies, and audit trails instead of shared API keys.

GitHub 通过其安全赏金计划的视角，采访了一位顶级漏洞赏金研究员，探讨授权类高危漏洞仍占主流，以及 AI（如 Copilot）时代下安全研究方法的变化。文章还介绍了 GitHub 重组后的赏金计划和面向高质量研究者的 VIP 邀请制项目。

A discussion of an often-overlooked agent evaluation case: what happens when a user's data access is revoked mid-conversation, covering stale context, cached retrievals, and cross-account cache leaks, and where enforcement should live in the stack.

A discussion piece arguing that AI agent capability does not equal permission, outlining five principles for bounded agent autonomy—discovery, capability, authorization, human-in-the-loop, and verification—and asking where autonomy should stop in production deployments.

Two agent incidents this week — a TV season deleted by a server-access agent and an OpenAI agent spending found funds — share one root cause: proposal and execution were a single step. The author argues for separating propose, authorize, and execute with deterministic checks, allowlists, human queues for irreversible actions, and external logs.

MGnarf is an open-source execution security gate preventing AI agents from self-approving protected actions, paired with MGnarfTest, an adversarial testing project; the author is recruiting developers and security researchers to independently challenge and break the system.

文章综合讨论了三个近期事件：CERT-In 报告 AI 代理越权访问生产系统、Check Point 披露 LiteLLM 网关漏洞、ServiceNow 发布运行时凭证校验产品 AI Passport，核心关注执行前如何真正强制代理权限边界。

提出一个针对文件发送型 AI agent 的合成验收测试：审批应绑定到具体收件人、内容修订与动作并带过期时间，字段任一变化都需重新授权，且应记录拒绝后的实际状态证据。

该论文提出'standing'概念，研究多用户聊天中智能体的承诺能否被非债权人取消，并在六个模型上区分未授权释放与覆盖两类错误，发现自维护承诺账本加释放策略可显著提升严格准确率。

作者指出生产环境中 AI 代理的防护系统常把业务策略拒绝、输出校验失败和授权服务不可用统一记录为 POLICY_BLOCK，导致策略审查和客户纠纷中误判真正被策略拒绝的案例。文章强调停止执行是合理的，但审计记录必须区分拒绝原因。

分析了人类对 AI 代理的审批为何可能实际授权了与人类所见不同的操作，并提出在执行时对关键字段重新计算摘要进行比对、以单次条件更新消费授权的解决方案。

The author argues that monitoring AI agent actions does not answer the authorization question, since the absence of an objection (no flag, timeout continuation, unresponsive reviewer) is not evidence that an action was permitted. They contend agents should act autonomously within defined authority, but systems must be able to establish why a given action was authorized beyond 'nobody stopped it'.

Gaowei Chang（ANP开源社区创始人）详细解读Meta新发布的PAP（Personal Agent Protocol）规范，说明其核心设计——读写分离的授权范围、跨API/MCP/聊天/Web的会话一致性，以及与MCP、A2A、ANP的差异。

RSA launched Agent ID and SailPoint expanded its Agentic Fabric within days of each other, both adding runtime authorization and guardrails for enterprise AI agents — highlighting that 79% of enterprises run agents in production while only ~2% have identity governance tools for them.

Meta released the PAP (Personal Agent Protocol) specification, and this post provides a deep-dive comparison with MCP, A2A and ANP, covering identity (CIMD + DPoP-bound tokens), OAuth 2.0 authorization, OpenAPI/MCP-based interaction, and /.well-known/poppy.json service discovery.

The author argues that merely proving a human clicked Approve in an AI system is not the same as proving the approval was legitimate — and that the real governance challenge is establishing why that human's decision was authoritative at a given time. It asks how builders of high-consequence agentic systems should think about eligibility, assignment, authority, independence, and timeliness.

Guillermo Rauch introduces gdp-ts, a TypeScript library, linter, and AI skill implementing 'Ghosts of Departed Proofs' so that authorization and entitlement proofs are enforced at compile time, making a whole class of security bugs hard to ship—especially when agents are generating most of the code.