On this page
Payment or fulfillment does not make a resource safe to use as authority. Runtime authorization closes the gap between acquisition and activation.
Research status: Preprint. Original research date: 2026-09-13.
Authors: Genliang Zhu, Chu Wang. arXiv version: v2, revised 2026-09-18.
Earlier versions were indexed as AcquireBound: Runtime Authorization for Resources Acquired by AI Agents with Genliang Zhu as sole author. The current arXiv record uses the descriptive title above and includes Chu Wang; both entries identify the same paper, arXiv:2609.14744.
Overview
Autonomous agents can acquire compute, credentials, accounts, services, or other agents. Existing payment, budget, OAuth, mandate, and fulfillment checks may validate the transaction without deciding whether the returned resource should become usable authority inside the task.
The architecture quarantines every acquired output, resolves its actual capabilities from authenticated provider evidence, and activates it only through a current transaction that checks provenance, epochs, the resolved manifest, and correlated limits over identity, effects, data, delegation, and the wider resource graph.
Core contributions
Activation-gap formulation
Separates successful acquisition or fulfillment from the security decision that allows a returned resource to introduce new authority into an agent task.
Quarantine and resolution
Keeps acquired outputs inert until a versioned resolver derives their actual capabilities from authenticated provider evidence.
Relational authorization envelope
Binds activation to provenance, epochs, and downward-closed graph constraints that preserve correlated identity, effect, data, delegation, and graph-wide limits.
Effect-time enforcement
Revalidates and consumes single-use effect permits at linearization, with reference traces, an independent checker, tamper tests, MCP clients, staged Docker composition, and a multi-source field audit.
Evidence and scope
This is an arXiv preprint and a reference architecture, not a claim of production readiness. Its guarantees depend on authenticated provider evidence, complete mediation, correct resolution and normalization, authoritative epochs and linearization, and enforcement of the relational envelope. The reported MCP and Docker studies are deterministic or staged evaluations, and the field audit does not show that any surveyed unit supplies a complete production activation profile.
