(disclosure: i maintain the open-source project this came up in. link at the end. the question stands on its own.)
we hit a trust-boundary problem while building a deterministic authorization layer for agents, and i think it generalizes.
an engine can strongly protect its verdict:
- signed authorization
- intent binding
- state-hash binding
- replay protection
- trusted evaluation time
all solid.
but if the same compromised agent runtime can influence both the proposed action AND some of the premises used to evaluate it, what has crypto actually proven?
only this:
the signed decision is consistent with the supplied inputs
not this:
the supplied inputs came from authoritative sources
examples of premises a runtime might quietly supply:
- agent_id
- tool identity
- execution depth
- tenant context
- a state object the guard later hashes
the signature still verifies. the hash still matches. the decision is still deterministic.
but the premises may be self-reported.
two things i'd genuinely like challenged:
- which evaluator premises actually need independent provenance, and which can safely remain proposer-declared?
- for state, is an authoritative guard-side read enough, or should the state provider eventually emit a signed/versioned attestation?
most interested in confused-deputy paths, TOCTOU, and cases where a supposedly "trusted" premise can still be bent by the runtime.
[link] [comments]