Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents

Modern AI agents are increasingly designed to be long-lived and self-evolving. They retain experience, acquire new tools, and revise their own workflows to improve performance over time. While this adaptation is essential for complex, open-ended tasks, it creates a significant security risk: an agent's authority is typically granted based on its initial state. If the agent evolves—for example, by incorporating new, untrusted tool outputs into its memory or changing its internal logic—it may inherit the original grant while operating in a context the user never evaluated. This creates a gap where an agent could potentially exercise authority it was never intended to have.

The authors introduce a framework to manage this "authorization continuity." They argue that static authorization is insufficient for evolving systems, but allowing agents to dynamically adjust their own privileges is dangerous. Their solution relies on two primary mechanisms:

1. The Transition Envelope: This defines which mutations (e.g., skill acquisition, memory updates) an existing grant is permitted to survive. If an agent undergoes a change outside this envelope, the grant is suspended, regardless of whether the agent's current task is safe.
2. The Immutable Effect Ceiling: This is a hard boundary established at the time of the initial grant. While an agent may contract its active authority or expand it under strict, evidence-based conditions, it can never exceed the original ceiling. The authors prove that under complete mediation and sound effect abstraction, this structure prevents the amplification of protected effects beyond the user's initial authorization.

This research addresses the tension between agent utility and security. By separating the question of "is this agent still the one I authorized?" (the envelope) from "what is this agent allowed to do?" (the ceiling), the authors provide a principled way to allow agents to learn and adapt without granting them unchecked power. This approach is particularly relevant for high-stakes environments where agents interact with external systems, files, or sensitive credentials, as it ensures that even if an agent is compromised or drifts into unexpected behavior, its potential for harm remains bounded by the original, human-approved limits.