Does an AI Agent's Authorization Actually Bind the Action That Reaches the Executor?

Description and use

The author investigated that an AI agent's authorization may not be bound to the actual execution of an action, and created AgentGuard to ensure the authorized action matches the executed one by enforcing action integrity, boundary exclusivity, and authority freshness.

Problem

When an agent is authorized to perform an action, there is no guarantee that the same action is what eventually gets executed, leading to potential security gaps.

Outcome

AgentGuard passed 39/39 tests, demonstrating that it can enforce action integrity, boundary exclusivity, and authority freshness. Existing frameworks may or may not provide similar guarantees; the experiment invites community feedback.

Workflow

• Identify a consequential tool in the agent system
• Locate where authorization occurs
• Document the exact authorized action (tool, arguments, target, identity, context, policy state, expiry)
• Introduce a material change between authorization and execution (e.g., modify arguments, target, identity, or callable)
• Observe whether the system rejects the modified action

Evidence

The subsequent independent adversarial retest covered things such as argument changes, target changes, agent identity, runtime identity, capability substitution, replay, expiry, stale policy state, and legitimate execution. It passed 39/39 tests.

Source