Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors formalize the minimal "residual authorization state" required for language agents under dynamic permission revocation, proving that exponentially many future-divergent authorization histories can share an identical static reachability graph. This theoretical gap exposes a severe vulnerability in agent autonomy, as compressed execution traces or static snapshots inevitably fail to predict valid access paths after intermediate delegation edges are removed. Empirically, across four open-weight models evaluated on the ResidualAuth benchmark, LLM-generated memory summaries solved at most 1/128 revocable authorization pairs, whereas external authenticated query mechanisms and hard mediation gates reliably eliminated unauthorized side effects.
Two permission graphs can look completely identical today yet require opposite authorization decisions tomorrow, creating a theoretical trap where LLM-managed context compression fails dynamic tool revocation over 99% of the time.
Tool-using language agents can delegate and revoke permissions while acting through external services. We show that two authorization histories can have identical current permissions and identical all-pairs reachability yet require opposite decisions after the same direct-edge revocation. We formalize the information needed to preserve such distinctions as a residual authorization state. We prove that exponentially many future-distinct states can share one fixed transitive closure, and give exact or tight asymptotic bounds on the state required by an exact monitor as delegation redundancy varies. ResidualAuth compiles these constructions into paired language-agent episodes. Across four open-weight models, a fixed 256-token summary solved 0-2/16 pairs, sham reads solved 0/16, and authenticated current-query reads solved 15-16/16. In a separate held-out online-memory diagnostic, exact ledger serializations fit all 128 four-coordinate pairs at both 768 and 1,024 tokens. At either cap, factually supported model-written memories sufficient for every prespecified continuation solved at most 1/128 pairs per model. A hard gate reduced eight observed unauthorized effects to zero without changing the preceding attempts. These results distinguish required authorization state, usable decision information, online state maintenance, and effect mediation.