AID-Guard: Stateful Authorization for Delegated Agent Effects

TL;DR - AID-Guard is a stateful authorization protocol that binds an approved agent request to at most one provider-side effect across commits, retries, and crash recovery. It matters because conventional admission-time authorization can allow changed requests or duplicate effects when delivery outcomes are ambiguous.

• Revalidates both the approved request and provider state at commit, retaining a single reservation until a terminal result or certified no-effect outcome.
• A Python/SQLite prototype produced no unauthorized or duplicate effects across evaluated MCP, Stripe, and Resend mutations, races, retries, and recovery schedules.
• Under complete proposer compromise, it blocked all 44 tested attacks while admitting all 44 matched legitimate proposals.
• Strict exact-manifest authorization reduced benign utility by 35.4–43.8 percentage points; a typed frontier recovered 9–10 completions without observed unsafe effects.