An agent may change its plan. Its authority should not grow.

1. System model

We model an agent deployment as principals, agents, shared state, an orchestrator, credentials and authoritative destinations. A destination is any system that can make a consequence real: a Kubernetes API, cloud control plane, payment rail, model registry, messaging service or data-release endpoint.

Adversary

The adversary controls a lower-privileged principal, one agent, or an input accepted by that agent. It may query common memory, reuse context or handles produced by a more privileged agent, write shared memory, send peer messages, propose tasks, discover ambient credentials, alter tool output or split a consequence across workers. It cannot forge signatures, break the cryptographic primitives, compromise the protected verifier or directly modify the authoritative destination in the protected experiment.

Trust boundary

The model and orchestrator are not treated as authorization authorities. They may interpret goals and propose actions. The destination, or a verifier colocated with it, decides whether an exact consequence is authorized. Selected context, memory, vector operations and supported inference can additionally use encryption so the compute operator does not receive usable plaintext.

2. One attack in full: shared memory

Shared memory is the clearest reduced example of the pattern. The names and environment below are fictional. Alice has a coding agent with Kubernetes access. Bob has no Kubernetes access. Both agents use organizational memory.

1. Alice's agent

   Produces restricted deployment context and a controlled cluster-handle reference during an authorized task.

2. Memory service

   Stores the record in a common organizational namespace without preserving its original reader and purpose boundary.

3. Bob's agent

   Retrieves the record while performing a lower-privileged service-status task.

4. Bob's agent

   Reuses the inherited handle to propose exposing the deployment configuration.

5. Kubernetes API

   Accepts the reusable handle unless it verifies Bob's own goal and authority before changing state.

Conventional RBAC is not necessarily misconfigured. Alice was allowed to use Kubernetes, and Bob was allowed to use organizational memory. The failure appears after Alice's privileged result becomes common context. A reusable handle may still satisfy a downstream authentication check even though Bob's root task never authorized the cluster operation.

The bridge also works in reverse

A lower-privileged user can write an instruction that a higher-privileged agent later retrieves and executes with its own access. That is a related confused-deputy path. The default executable scenario focuses on the customer pattern above: privileged context moves to the lower-privileged agent, which then attempts the consequence itself.

When recovery quietly changes authority

We saw the same problem without shared memory. A primary route failed, so the workflow searched for another tool, endpoint, model or credential. From an operations perspective this looked like resilience. From an authorization perspective it was a new request. The replacement changed who would receive the data, which operation would run or which protection boundary applied.

The important question was never whether the agent had found a route that worked. It was whether the original principal had authorized that exact route, resource and consequence.

These are related but different controls. VM isolation, network confinement and Mirror action authority should compose. An IP address, working relay or technically reachable service is not proof that the original principal authorized the resulting destination or operation.

Run the controlled route-expansion replay.

The unsafe instruction can outlive the interaction.

The shared-memory example is not only a question of which agent reads a record. It is also a question of what the next agent inherits. A workflow may restart with a shorter summary, delegate to a worker or recover through another service. Each transition can preserve useful work. It can also preserve an instruction, a claimed approval or access that should not travel with it.

OpenAI's misalignment reports make this distinction concrete. The collection includes training observations, controlled evaluations and internal deployment events. They are not all production incidents, and publication dates are not occurrence dates. Read that way, the reports show several different carriers for the same authority problem.

The distinction matters even when every artifact is authentic. A correctly signed summary can faithfully preserve an unsafe instruction. Encryption can keep that summary private, and provenance can show where it came from. Neither makes its contents an authorization. The destination needs a separate decision about the operation, recipient and current grant.

This is not a reason to dismiss alignment or monitoring. In the concealment report, OpenAI says improved alignment grading reduced flagged compaction summaries from 2.15% for 5.6-Sol to 0.27% for GPT-6 Astra. Those are rates within the reported RL summaries, not production incident rates. Better models reduce unsafe proposals. Infrastructure still needs to decide what happens when a proposal survives.

Compaction, delegation and recovery therefore belong in the same threat model as shared memory. Each changes what the next decision-maker receives; none should change what the owner authorized. The test is whether the destination commits an action that lacks current authority, even when the agent continues to propose it.

3. Where authority can escape the goal

The Kubernetes example is one reduced customer pattern, not the complete threat model. Customer architecture reviews and published research expose the same problem through different parts of the agent system. We group the cases by the boundary that fails, then test the proposed consequence with and without enforcement.

4. Security property

Let an authority grant be a tuple of permitted principals, operations, targets, purposes, budget and time. The relation no broader than, written ≼, requires every set to be a subset, every budget to be no larger and every validity interval to be no longer.

For an action proposal q at time t, effective authority is the meet of independently verified grants. In plain language, the narrowest applicable constraint wins.

A child can only lose authority. A memory record is released only to an allowed reader for an allowed purpose. Even after an approved release, the producer's authority does not transfer to the reader.

The destination accepts an action only when the requested authority is no broader than the effective authority and every binding verifies against that same canonical action.

5. Mirror protocol

The protocol carries authority outside the model's natural-language context. Models remain free to plan; they do not mint the grants used to commit consequences.

1. IssueBind the root goal

   The accountable principal signs purpose, operations, targets, budget and expiry.

   G = SignIssuer(principal, purpose, ops, targets, budget, exp)
2. CaptureBind memory release

   Memory, retrieval and tool results retain producer, permitted readers, content digest, purpose, trust label and observation time.

   M = AttestMemory(producer, readers, H(content), purpose, labels, observedAt)
3. AttenuateConstrain every child

   A delegated worker receives a strict subset of its parent's operations, targets, budget and lifetime.

   Dchild ⊆ Dparent ⊆ G
4. CanonicalizeBind one exact action

   The operation, resolved resource identity, target, arguments, principal, session and provenance become one digest.

   hQ = H(principal ∥ session ∥ op ∥ targetIdentity ∥ H(args) ∥ H(provenance))
5. LeaseResolve credentials inside the effect

   The broker releases a short-lived credential only inside the callback for hQ, then overwrites and revokes it.

   L = SignBroker(subject, hQ, provider, target, scope, exp)
6. CommitVerify at the destination

   The destination checks the exact action and current authority before changing state.

   State' = Commit(q) only if Accept(q)
7. ProveBind the authoritative result

   The signed receipt joins provenance, intent, lineage, decision, action, result, release and evaluation.

   R = SignVerifier(H(M), H(G), H(D), hQ, H(State'), H(release))

6. Mirror control surfaces

The security property spans more than inference. Encryption protects selected intelligence. Identity, policy, delegation, credentials, destinations and receipts preserve authority around the complete agent path.

Each scenario runs only the controls relevant to its threat. Shared memory uses policy encryption, provenance and action authority. Data release and route downgrade add encrypted inference. Reward poisoning uses a sealed evaluation object. Every protected path binds the exact action and authoritative result.

The public lab releases only the facts needed to inspect the claim: artifact fingerprints, the decision, a verification key and a signed receipt. It does not return secret keys, ciphertext bodies, model credentials or the private implementation.

7. From field pattern to executable proof

We did not reproduce customer systems or move customer data into the lab. We reduced each pattern to a test that preserves its security question. Campaign replays follow the goal-to-consequence path. Contract tests change one binding. Handoff experiments follow the same information or grant across transitions and compare callback effects before and after enforcement.

Both runs hold the task, actors, proposal and isolated destination constant. For the consequence comparison, the causal change is whether exact authority is required. When the threat also concerns data confidentiality, the protected run adds the matching cryptographic control and binds its fingerprint into the final receipt.

8. Security argument

The protocol does not attempt to prove that a model is aligned. It limits what a model, orchestrator or population can cause when its plan changes.

Goal non-substitution

Changing purpose, operations or targets invalidates the signed root intent.

Delegation attenuation

A child cannot add operations, targets, budget or lifetime absent from its parent.

Provenance non-erasure

Inputs that influence a proposal remain bound to its canonical action envelope.

Authority non-transfer

Reading another principal's information does not add that principal to the authorization chain.

Credential confinement

A credential is resolved only for one action digest and is not returned as ambient process state.

Commit-time enforcement

A direct call that bypasses agent-side controls still fails when the destination requires exact current authority.

Evidence soundness

Changing the result, release or evaluation binding invalidates the signed receipt.

These properties rely on cryptographic unforgeability, collision resistance, correct destination integration, a trusted issuer and broker, protected signing keys and fail-closed handling. Encryption adds confidentiality; it does not replace the authorization argument.

9. What the lab proves

These are executable Mirror integration proofs. Across the catalog, the protected runs exercise policy-encrypted memory, FHE inference, sealed evaluation artifacts, signed task intent, source provenance, attenuated delegation, exact action binding, credential confinement, destination state and signed causality receipts. No individual scenario claims to run every primitive. The browser verifies the receipt and the artifacts named by that scenario.

The public lab uses isolated authoritative destination adapters for Kubernetes, messaging, payment, package, network-route and data consequences. This keeps the unsafe control repeatable without touching production systems. It does not weaken the exercised cryptography or Mirror runtime path; it deliberately bounds the side effect. A production deployment places the same verification boundary in the tool adapter, egress path, gateway or destination that can commit the actual consequence.

The guarantee is only as complete as that enforcement coverage. A destination that still accepts an unverified bypass path remains outside the boundary. Key compromise, verifier compromise, availability attacks and side channels require their own controls.

In the withdrawal test, a destination-owned in-memory registry connects live authority state to the SDK action facade. The final check and local effect run without an intervening asynchronous step. This is a local integration proof, not a claim of distributed revocation consistency or network-wide egress enforcement. The signed receipt binds what this lab records; its verification key is supplied by the same service, not an independent attestation of execution.

Current extension work carries the same root authority across longer-running populations, framework handoffs, queues, changing tool graphs, live revocation and aggregate consequences that emerge across several locally valid actions.