Canonical Action Verification and Attestation (CAVA), a runtime-semantics layer for converting heterogeneous agent activity into canonical runtime action objects, is presented.
Abstract
Agentic AI systems increasingly act through heterogeneous runtimes: local coding hooks, SDK tools, browser automation, managed-agent traces, API gateways, and workflow engines. A single operational act such as publishing code, changing identity state, moving money, or exporting data may therefore be represented by many incompatible runtime records. This makes a basic governance question difficult to answer: what action was actually approved, what evidence binds the approval to execution, and can an independent verifier reproduce the same action identity later? This paper presents Canonical Action Verification and Attestation (CAVA), a runtime-semantics layer for converting heterogeneous agent activity into canonical runtime action objects. CAVA is positioned below Proof-Carrying Agent Actions (PCAA): PCAA defines the deployer-owned route-review-prove governance process, while CAVA defines the stable action object that process governs. The paper formalizes canonical action identity, semantic pattern detection, approval binding, receipt integrity, runtime-portable projection, and optional attestation substrates. We study a reference implementation through a 96-seed, 384-variant benchmark covering semantic equivalence, semantic separation, wrapper bypass, false-positive control, approval binding, receipt reproducibility, attestation tamper detection, runtime portability, semantic pattern detection, policy degradation, and Azure deployment drills. The contribution is a systems formulation of action-level canonicalization and policy-addressable semantic patterns as a necessary substrate for deployer-side AI governance.
Autonomous AI agents now hold execution authority over high-consequence enterprise actions in finance, healthcare, and infrastructure, where catastrophic failures are rare yet dominate systemic risk and probabilistic content filtering does not constitute a reference monitor over what is executed. This paper introduces L-DREA, a deterministic runtime-enforcement architecture that generalizes Anderson’s 1972 reference-monitor primitive from mediation of data access to mediation of externally effective action. L-DREA separates capability generation from execution authority, binds every candidate action to an epoch-keyed Permit-to-Act token, and interlocks externalization through a commit-before-actuate substrate. Five structural properties generalize Anderson’s primitive — complete mediation, tamper-resistance, verifiability, non-compensatory aggregation, and epistemic bounding — and six runtime invariants are established analytically, the first additionally mechanized in TLA+ with a released TLC log. A software (Tier-S) reference implementation is evaluated on two disjoint evidence tracks: a seeded synthetic corpus of 1,217,906 runtime proposals (360,000 adversarial), and the public ULB credit-card dataset (284,807 transactions) as a golden-oracle authorization trace, plus a blind committed-before-label-reveal protocol on three public datasets. Across both tracks, a 120,000-attempt full-knowledge adaptive attacker, 2,394 injected runtime attacks, live revocation and watchdog suites, and an executed offline AgentDojo run, zero unauthorized externalizations were observed; exact one-sided Clopper–Pearson and Wilson upper bounds accompany every zero-event claim, with replay determinism of 100.0000% over 1,217,906 cycles and 24,912 Ed25519-signed permit tokens runtime-verified at 100% integrity. All results are bounded to the documented threat surface and released as a seeded, one-command reproducible artifact; hardware substrates and HSM key custody are specified, not claimed.
AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems, is presented and results are preliminary and scoped to the modeled policy-visible agent behaviors and evaluated benchmarks.
This work presents FAVA (Formal Authorization for Verified Agents), a permission-carrying authorization framework for agent execution that utilizes an LLM-guided Permission Intermediate Representation to translate ambiguous natural-language tasks into structured constraints.
Yifan Zhang, Xinkui Zhao, Sai-Da Liu et al.· arXiv.org· 3 citations
A pipeline promoting an AI system publishes records claiming the thing evaluated is the thing deployed and that the evidence licensed the transition, and measures whether those records can express that claim and whether it holds where declared.
This work introduces the concept of an agentic transaction and proposes an ACID-compliant agent system framework that reinterprets the classical ACID properties for agent execution through four semantic guarantees: Semantic Atomicity, Semantic Consistency, Semantic Isolation, and Semantic Durability.
Tool-augmented LLM agents must rely on untrusted runtime Observations to complete open-ended tasks; however, when tool outputs no longer merely provide data but begin to specify concrete actions, they effectively become ``commands''that can drive real-world side effects beyond user intent. We argue that this risk arises from conflating action induction with execution authorization. To address this distinction, we propose SARA, which treats action induction and execution authorization as distinct runtime roles and separates action provenance from execution authority. On the Observation side, a context-isolated Action Probe exposes action-inducing semantics and persistently records action-origin provenance across steps as a review signal; on the execution side, actual tool calls are authorized only against the user objective and audited evidence from authorized successful executions, while satisfying goal, execution-chain, and argument-level support. To preserve this separation across multi-step execution, SARA applies No-History-Promotion to prevent historical recurrence from laundering action origins into execution authority. Across AgentDojo and AgentDyn, SARA limits ASR to no more than \(0.63\%\) across four primary evaluation settings while maintaining competitive task utility, and consistently reduces ASR across additional Agent backbones.
Xiao-Kun Guo, Zhen Xu, Dongdong Huo et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
