Search papers, labs, and topics across Lattice.
This paper addresses the authorization challenges posed by long-lived AI agents that evolve post-deployment, emphasizing the risks of model errors and prompt injections leading to unintended actions. The authors introduce the concept of authorization continuity, defining conditions under which existing grants of authority remain valid despite the agent's evolution. Their state-bound model establishes a fixed transition envelope and an immutable effect ceiling, ensuring that while authority can contract, it cannot expand beyond user-defined limits without proper evidence, thereby safeguarding against unauthorized actions.
Evolving AI agents can inadvertently exceed their authorized actions, but a new model ensures that their authority remains tightly controlled even as they adapt.
Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. This improves adaptation but creates a distinct authorization problem. Tool-enabled agents can turn model errors and prompt injections into consequential external actions; when evolution occurs under a live grant, the subject exercising that authority or the context in which it acts may no longer match what the user evaluated. Evolution can change both the effects reachable under an old grant and the authority required by the task, which may rise, fall, or become incomparable. Existing tool policies constrain actions but do not determine when a grant survives this change. We formulate authorization continuity: when does an existing grant remain valid, how may active authority change, and what boundary must never move? Our state-bound model fixes a transition envelope and an immutable effect ceiling at grant time. The envelope determines whether the grant survives a mutation; below the ceiling, authority may contract freely and expand only under specified evidence conditions. We distinguish requested from realized effects and prove that, under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling. Agent-produced evidence may allocate authority below the ceiling but cannot raise it. Finally, we map six mutation classes to their authorization consequences.
