multiagentsecurity.ai Research site

Article page

From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions

Review the paper summary, metadata, and source links for this recent publication.

Mengting Wu, Lin Wang, Yong Zhang, Jiang Deng

Published 2026-09-10

Actions

Open source record

Open PDF

Back to latest research

arXiv preprint arXiv Governance and Policy Trust and Identity

Venue: arXiv

Reviewer: The paper focuses on defining an execution-boundary conformance profile for AI-generated actions, addressing execution authority, evidence, and policies. While it primarily discusses authorization and execution controls, it also touches on control problems and governance aspects in AI systems. Although it does not explicitly discuss multiple interacting agents or multi-agent attacks, the considerations of execution grants and policy enforcement in AI actions align with governance and control challenges in multi-agent AI systems. Therefore, it is moderately relevant to the topic of multi-agent security research.

Abstract

AI agents increasingly propose actions with external consequences, including financial transfers, infrastructure changes, software deployments, disclosures, and physical actuation. Authorization engines, policy languages, runtime monitors, provenance mechanisms, and agent guardrails provide important foundations, but do not necessarily define a common semantic contract for the final transition from a particular candidate action to execution authority. We specify EBL-Core, an execution-boundary conformance profile for deciding whether one canonical, fully materialized AI-generated candidate may receive action-scoped execution authority under explicit conditions. It binds a structured intent object, Root and Operational Policies, evidence obligations, typed evidence, context, time, and a verifiable Decision Derivation through an Execution Release Contract (ERC). An ERC is not an authority-bearing token; a verified ALLOW ERC may support a separate Execution Grant governed by Redemption-time validation. EBL-Core specifies action binding, policy non-weakening, evidence handling, deterministic adjudication, derivation verification, and grant lifecycle behavior. An accompanying reference artifact provides schemas, adjudication, separate verification and Semantic Replay, and a linearizable in-memory grant store. In the retained run, 34 static vectors and 15 lifecycle checks matched expected outcomes. Across 100 trials, 32 concurrent Redemption attempts yielded exactly one successful Redemption and protected test effect per trial; 100 Revoke-Redeem races ended in valid terminal outcomes. These bounded results demonstrate executability of the specified subset, not human-intent correctness, evidence truth, complete mediation, production readiness, mechanized correctness, or deployment-level security.

Bullet summary

  • The paper addresses the challenge of securely authorizing high-risk AI-generated actions that have real-world consequences, such as financial transfers or infrastructure changes, by defining a clear semantic contract between AI intent and action execution.
  • Introduces EBL-Core, an execution-boundary conformance profile that binds a fully materialized AI-generated candidate action with structured intent objects, root and operational policies, evidence obligations, context, and verifiable decision derivations wi...
  • EBL-Core emphasizes deterministic and side-effect-free adjudication semantics, ensuring root-policy dominance and strict evidence handling to prevent unauthorized weakening of policy obligations.
  • The model separates the roles of adjudication, grant issuance, and redemption, mandating linearizable lifecycle management of execution grants to guarantee at-most-once execution and prevent race conditions.
  • A formal semantics framework is provided, defining canonical identity, intent-to-candidate binding, prioritized failure handling, decision derivation verification, and proof of security properties such as single-use consumption and evidence obligation safety.