AI agent authorization: five papers, one gap, different fixes

Five new arXiv papers approach AI agent authorization from different angles, but they share a common diagnosis: the permissions an agent inherits are not the same as the authority it should exercise. One paper argues that integration credentials often exceed what a user's current request implies, and proposes a server-side layer that converts intent into access decisions. Another makes a similar move for tool execution, requiring the server to verify action claims instead of trusting free-form rationales that models attach to calls.

A second pair of papers looks at the edges of agent authority. One examines runtime authorization for resources agents acquire along the way—compute, credentials, accounts, services—and suggests checks tied to payment, budget, OAuth, mandate, and fulfillment. Another focuses on revocation for long-running agents that outlive their initiating processes through delegation, queues, callbacks, and provider-side operations, noting that cancellation and credential revocation do not close every gap.

The fifth paper supplies a measuring stick. APort Vault replays 4,371 human-written attacks against a live payment agent during a public capture-the-flag event, across 14 models from 8 labs. Where the other papers propose mechanisms, this one offers a benchmark for comparing them.

The papers differ in scope—tool calls, resource acquisition, revocation, payment—but they converge on a shared premise: agent authority must be checked at runtime, not assumed from static credentials. The benchmark makes that premise testable.