Search papers, labs, and topics across Lattice.
This paper introduces a formal model for Cryptographically Verifiable Agent Authorization (CVA) that aims to enhance the security of autonomous AI agents by providing cryptographic evidence of authorization requests in specific execution contexts. The authors define essential security properties such as authorization soundness and request binding, and they implement a proof-of-concept using a Groth16 zk-SNARK construction to demonstrate the feasibility of their approach. By addressing the structural separation of identity, request, and execution bindings, this work lays the groundwork for more secure agentic systems, highlighting a critical gap in existing frameworks.
Cryptographically verifiable authorization could be the key to ensuring that autonomous AI agents operate securely and in compliance with established policies.
Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority, but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted $R_{CVA}$, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems (a distinction {not explicitly addressed by} current agentic security frameworks) and present a falsifiable research agenda for its resolution.
