arXiv：cs.AI· Lifei Liu, Haoran Yu, Danping Zhang·· 16 小时前
分布式 Agent 工具网关的撤销不能以送达为准：C0-C5 可执行结果契约
Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways
AI 导读
论文提出 C0-C5 结果契约，将分布式 Agent 工具网关的撤销从签发提交延伸到效果阻止，并在含 8 个物理网关、2 个持久化接收端和 16 台 AWS 主机的 Keycloak 26.7 环境中验证。
正文
Abstract:Distributed agent workflows cache delegated authority at tool gateways. Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped. We define C0-C5, a bounded outcome contract spanning issuer commit through effect prevention, and implement it as a persistent monitor over a frozen gateway set, call set, and observation window. A 14-case fault matrix checks conservative classification, sticky violations, restart persistence, and evidence immutability. In a derived audit of its eight semantic cases, treating C3 or C4 as completion produces seven or five false positives, respectively; the bounded C0-C5 verdict produces none. Descriptive scaling covers 1,024 gateways and 10,000 effect vectors. The primary experiment uses the maintained Keycloak 26.7 identity server and measures the contract across two durable receivers, eight physical agent-tool gateways, Filesystem and PostgreSQL effects, and 16 AWS hosts in three availability zones. Normal delivery and recovery commit no effects. Under receiver-selective non-delivery, transport acknowledgment and receiver persistence still succeed, but 112 of 225 calls (49.78%) are admitted, and all 112 effects commit in every treatment block. A separately provisioned execution repeats the result. OPA/Toxiproxy and a live three-role LLM workflow with networked MCP tools reproduce the persisted-but-not-enforced boundary on narrower surfaces. Finally, an unmodified external MCPMark agent executes 60 closed-loop task arms. Normal C4 denies all 31 exposed post-barrier calls and commits no effect; selective C3 allows 344 calls and commits 145 effects across Filesystem and PostgreSQL. Transport success is therefore evidence of progress, not a revocation-completion verdict.
| Subjects: | Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2610.15991 [cs.AI] |
| (or arXiv:2610.15991v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.15991 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Lifei Liu [view email]
[v1]
Sun, 11 Oct 2026 23:41:18 UTC (137 KB)
来源：arXiv：cs.AI · arxiv.org