Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways
Distributed agent workflows cache delegated authority at tool gateways.
ProofPaper ↗
Key points
- Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped.
- We define C0-C5, a bounded outcome contract spanning issuer commit through effect prevention, and implement it as a persistent monitor over a frozen gateway set, call set, and observation window.
- A 14-case fault matrix checks conservative classification, sticky violations, restart persistence, and evidence immutability.
- OPA/Toxiproxy and a live three-role LLM workflow with networked MCP tools reproduce the persisted-but-not-enforced boundary on narrower surfaces.
Sources (1)
- [1]Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool GatewaysarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 11, 11:41 PM
Distributed agent workflows cache delegated authority at tool gateways.
Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 11, 2026Apple launches HomeView, its first smart display for the home
- Oct 11, 2026Agent Speedrun — Elizabeth Fuentes Leone & Sandhya Subramani, AWS
- Oct 10, 2026When the Safety Test Became the Threat: The Machine That Found Its Own Way Out
- Oct 9, 2026anthropics/claude-code v2.1.296
- Oct 9, 2026pydantic/pydantic-ai v2.55.0: v2.55.0 (2026-10-09)
- Oct 9, 2026Introducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash