Toward cryptographically verifiable authorization for autonomous AI agents: A security hypothesis, preliminary formal model, and proof-of-concept implementation
摘要
Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority, but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted $R_{CVA}$, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems (a distinction {not explicitly addressed by} current agentic security frameworks) and present a falsifiable research agenda for its resolution.
正文
Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority, but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted $R_{CVA}$, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems (a distinction {not explicitly addressed by} current agentic security frameworks) and present a falsifiable research agenda for its resolution. Authors: M. Llambí-Morillas, D. Fernández-Fernández Categories: cs.CR, cs.AI PDF: https://arxiv.org/pdf/2607.21325v1 Comment: 11 pages, 1 figure, 2 Tables. Keywords: autonomous AI agents, zero-knowledge proofs, verifiable authorization, agentic security, zk-SNARKs, access control, cryptographic authorization, cryptographic protocols, zero-trust architecture, pre-execution authorization. Submitted to ACM Transactions on AI Security and Privacy (TAISAP)
标签
- category:cs.ai
- category:cs.cr
- primary_category:cs.cr
- source:arxiv
- type:paper
扩展字段
{
"arxiv_id": "2607.21325v1",
"authors": [
"M. Llambí-Morillas",
"D. Fernández-Fernández"
],
"categories": [
"cs.CR",
"cs.AI"
],
"comment": "11 pages, 1 figure, 2 Tables. Keywords: autonomous AI agents, zero-knowledge proofs, verifiable authorization, agentic security, zk-SNARKs, access control, cryptographic authorization, cryptographic protocols, zero-trust architecture, pre-execution authorization. Submitted to ACM Transactions on AI Security and Privacy (TAISAP)",
"doi": null,
"entry_id": "https://arxiv.org/abs/2607.21325v1",
"pdf_url": "https://arxiv.org/pdf/2607.21325v1",
"primary_category": "cs.CR",
"search_query": "cat:cs.CR",
"updated_at": "2026-07-23T13:55:02+00:00"
}