Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents

arXiv:2607.10487v2 Announce Type: replace-cross Abstract: An LLM agent often acts on an approval it observed earlier: it reads the approval, prepares the request, and commits later. If the approval was withdrawn, or covers a different effect, the service can apply the change and report success. Seventeen fixed advisories from three deployed agent products document failures: an approval did not cover the executed effect, with no intervening change (12), or survived a change in the facts it depended on (5). We propose commit-time authorization (CTA), requiring at least one complete, current justification for the exact effect at commit: a live grant, current premises, ready dependencies, an exact-effect binding, and an eligible path. CommitGate selects one complete justification. The sink validates it or consumes an expiring, single-use derived grant atomically with the effect. In a five-model service study whose prompt states the authorization rule, timely notice prevented nearly all unauthorized effects for GPT, Fable, and Sonnet, and fewer for Qwen and Gemma. Without a signal, all five mostly completed tasks with unauthorized effects, even when a read could reveal the change; Fable's counts use its provider's answered requests. Protected sinks enforced the declared policy in LangChain approval flows, OpenHands coding tasks, services under cloud contention, and a transaction-runtime integration. The services and runtime refused effects that lost authority after a positive check and preserved fresh alternatives. After refusal, GPT, Fable, and Sonnet on OpenHands mostly published to a separately authorized target. Machine-checked proofs show whole-candidate selection, trace safety for mediated atomic sinks, and exact single-use transfer. With honest issuers, unique candidate IDs, and a premise required by policy, every candidate CTA accepts in the model carries a live grant given at the current version; slot-by-slot checks do not ensure this.