Search papers, labs, and topics across Lattice.
The paper addresses the problem of temporal incoherence in Identity and Access Management (IAM) systems under agentic execution, where revocation windows allow for a large number of unauthorized API calls. It introduces a Capability Coherence System (CCS) and maps it to a MESI cache coherence protocol, demonstrating that Release Consistency-directed Coherence (RCC) provides a safety guarantee bounding unauthorized operations by the number of agents, independent of agent velocity. Discrete event simulations across various scenarios confirm that RCC achieves a significant reduction in unauthorized operations compared to TTL-based lease strategies, particularly in high-velocity and anomaly-triggered revocation scenarios.
Traditional time-based authorization schemes are dangerously slow in multi-agent systems: a new coherence strategy slashes unauthorized API calls by over 100x, offering a velocity-agnostic safety guarantee.
The temporal assumptions underpinning conventional Identity and Access Management collapse under agentic execution regimes. A sixty-second revocation window permits on the order of $6 \times 10^3$ unauthorized API calls at 100 ops/tick; at AWS Lambda scale, the figure approaches $6 \times 10^5$. This is a coherence problem, not merely a latency problem. We define a Capability Coherence System (CCS) and construct a state-mapping $\varphi : Σ_{\rm MESI} \to Σ_{\rm auth}$ preserving transition structure under bounded-staleness semantics. A safety theorem bounds unauthorized operations for the execution-count Release Consistency-directed Coherence (RCC) strategy at $D_{\rm rcc} \leq n$, independent of agent velocity $v$ -- a qualitative departure from the $O(v \cdot \mathrm{TTL})$ scaling of time-bounded strategies. Tick-based discrete event simulation across three business-contextualised scenarios (four strategies, ten deterministic seeds each) confirms: RCC achieves a $120\times$ reduction versus TTL-based lease in the high-velocity scenario (50 vs. 6,000 unauthorized operations), and $184\times$ under anomaly-triggered revocation. Zero bound violations across all 120 runs confirm the per-capability safety guarantee. Simulation code: https://github.com/hipvlady/prizm
