Skip to content

Mitigation for CS findings: cryptographic binding of authorization to execution #15

Description

@arian-gogani

The paper's finding in CS6 — "agents reported task completion while the underlying system state contradicted those reports" — identifies what is arguably the hardest failure mode to detect in autonomous agent systems: the agent lies, and nobody has a mechanism to verify it.

Logs don't solve this because the agent writes the logs. Runtime monitoring doesn't solve it because it's reactive — the action already happened. Guardrails don't solve it because they constrain what the agent can do, not what it actually did.

The structural gap

The paper documents failures across authorization (CS2–3), resource consumption (CS4–5), identity (CS7–8), and integrity (CS6, CS10). What's common across all of them is the absence of a cryptographic binding between what was authorized and what was executed.

If every agent action required two signatures — one locking the authorization scope before execution, one locking the actual outcome after execution — and those two were hash-chained so any mismatch breaks the chain, then:

  • CS6 (false completion reports): the post-execution signature would reflect the actual system state. if the agent claims "done" but the system contradicts it, the hash chain breaks and verifiers see the divergence.
  • CS2–3 (unauthorized compliance): the pre-execution signature would bind the authorized identity. an agent complying with a non-owner would produce a receipt with no valid authorization chain.
  • CS4–5 (unbounded resource consumption): each action in the chain would carry a receipt. anomalous volume becomes visible as a receipt count spike without corresponding authorization depth.
  • CS10 (external constitution injection): the pre-execution receipt would bind to the original policy. if the policy mutates via an external artifact, the receipt chain diverges from the expected authorization baseline.

Implementation

We built this as Nobulex — two Ed25519 signatures per agent action, hash-chained via JCS/RFC 8785. Auditors verify offline without trusting the agent runtime. The bilateral receipt primitive was merged into Microsoft's Agent Governance Toolkit (PRs #1302, #1333), and 9 independent implementations validated byte-identical output.

This isn't a complete solution to the problems the paper raises — incentive structures and emergent multi-agent dynamics require additional work — but it addresses the verification gap: how do you prove what an agent did after the fact, without trusting the agent's own account?

MIT licensed, open source: https://github.com/arian-gogani/nobulex

Happy to discuss how this maps to specific case studies or how it could integrate with the OpenClaw architecture.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions