AID-Guard: Stateful Authorization for Delegated Agent Effects
Ranking
Overall
92
Content
100
Popularity
72
Observed public metrics from 1 member.
Merged summary
TL;DR - AID-Guard is a stateful authorization protocol that binds an approved agent request to at most one provider-side effect across commits, retries, and crash recovery. It matters because conventional admission-time authorization can allow changed requests or duplicate effects when delivery outcomes are ambiguous.
- Revalidates both the approved request and provider state at commit, retaining a single reservation until a terminal result or certified no-effect outcome.
- A Python/SQLite prototype produced no unauthorized or duplicate effects across evaluated MCP, Stripe, and Resend mutations, races, retries, and recovery schedules.
- Under complete proposer compromise, it blocked all 44 tested attacks while admitting all 44 matched legitimate proposals.
- Strict exact-manifest authorization reduced benign utility by 35.4–43.8 percentage points; a typed frontier recovered 9–10 completions without observed unsafe effects.
Sources (1)
AID-Guard: Stateful Authorization for Delegated Agent Effects
Public signals
Semantic Scholar citations 2 · Semantic Scholar influential citations 0
TL;DR - AID-Guard is a stateful authorization protocol that binds an approved agent request to at most one provider-side effect across commits, retries, and crash recovery. It matters because conventional admission-time authorization can allow changed requests or duplicate effects when delivery outcomes are ambiguous.
- Revalidates both the approved request and provider state at commit, retaining a single reservation until a terminal result or certified no-effect outcome.
- A Python/SQLite prototype produced no unauthorized or duplicate effects across evaluated MCP, Stripe, and Resend mutations, races, retries, and recovery schedules.
- Under complete proposer compromise, it blocked all 44 tested attacks while admitting all 44 matched legitimate proposals.
- Strict exact-manifest authorization reduced benign utility by 35.4–43.8 percentage points; a typed frontier recovered 9–10 completions without observed unsafe effects.