Skip to content

Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance

Sep 2026 · 0 citations · 43 references
Computer Science

Abstract

Reasoning systems usually treat premise use as a question of relevance: if a fact is available and useful, it may be selected for inference. Authorization imposes a different constraint: a premise may be represented and logically usable but not permitted for a particular local transition. We formalize this distinction as Governed Deduction (GD), with a transition-local admission predicate admit(p, tau, S). From an independently produced RBAC-augmented Spider benchmark, we construct 4,461 matched authorization pairs in which the same query premise and policy state support permitted and denied consuming transitions. An initial joint controller reaches 99.19% held-out accuracy, but a transition-only control reaches 100%, exposing a role-name shortcut. After a frozen, label-independent context-local role permutation removes that shortcut, premise/state-only, transition-only, and joint linear controllers all score exactly 50% on 1,856 held-out edges, while a symbolic policy oracle remains at 100%. The result is a controlled negative finding: the benchmark instantiates policy-grounded authorization beyond relevance, but the frozen linear representation does not recover the relation. Matched one-sided controls and leakage audits are therefore essential for evaluating learned policy-sensitive reasoning.

View source

Similar papers

Preprint Sep 2026

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

This work introduces ResidualAuth, a theory-grounded framework characterizing the authorization state agent systems must preserve and evaluating its maintenance and use, and proves that exponentially many distinct residual states can nevertheless agree on who can reach whom through delegation paths.

M. Choi, Seokho Jeong, Sian Choi et al. · 2 citations
Preprint Aug 2026

AID-Guard: Stateful Authorization for Delegated Agent Effects

This work presents AID-Guard, a stateful authorization-to-effect closure protocol that revalidates the approved request and provider state at commit, retains one reservation under ambiguity, and permits release or one successor only after a terminal result or certified no effect with a delivery fence.

Yingzhe Tong, Le-Yu Dai, Song-Hui Guo · 9 citations
#artificial intelligence Preprint Oct 2026

Runtime Authorization of Self-Generated Subgoals in Long-Horizon Tool-Using AI Agents

Long-horizon tool-using AI agents create subgoals, replan, delegate work, and compose sibling results. Per-tool permission checks cannot establish that a changing goal graph remains within the principal-approved task. We address this authorization gap in a finite structured domain with one principal and one authorizati...

Gen-Liang Zhu, Chu Wang · 0 citations
#artificial intelligence Preprint Sep 2026

Authorization Closure Graph: Minimal Repair for LLM Agents with Evolving User Instructions

An Authorization-Closure-Graph (ACG)-based framework that represents authorization and its dependencies as an evolving, versioned state that selectively invalidates authority affected by a revision while preserving unaffected portions of the authorization state, and computes a minimal repair.

Qing-Zhuo Wang, Cai-Yi Wang, Jing-Lu Meng et al. · 0 citations
#artificial intelligence Preprint Sep 2026

NAQD Env: A benchmark for selective withdrawal in language agents

Language agents must revise planned actions when evidence changes, permission is revoked, or a stop instruction arrives. A useful response is selective: suspend affected actions, preserve unaffected work, and resume only after sufficient repair. We introduce NAQD-Env, a synthetic environment that evaluates these decisi...

Mohamed Abouzahra · 0 citations
Preprint Sep 2026

Runtime Authorization for Resources Acquired by AI Agents

A provenance-bounded runtime authorization architecture that quarantines acquired outputs, resolves their actual capabilities from authenticated provider evidence through a versioned resolver, and activates them only through a current activation transaction that checks the resolved manifest, provenance, epochs, and a d...

Gen-Liang Zhu, Chu Wang Accentrust, Georgia Institute of Technology et al. · 0 citations

Related blog posts

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.