arXiv cs.AI· Lifei Liu, Haoran Yu, Danping Zhang·· 3 天前AI 评分22
分布式智能体工具网关的撤销完成判定：C0-C5 可执行结果契约
Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways
AI 导读
论文提出 C0-C5 有界结果契约，用于判定分布式智能体工具网关的撤销是否真正完成，并以持久化监控在冻结网关集上实现。在 Keycloak 26.7、8 个物理网关、Filesystem 与 PostgreSQL 效果及 16 台 AWS 主机的实验中，接收端选择性不投递时传输确认与接收端持久化仍成功，但 225 次调用中 112 次（49.78%）被放行且效果全部提交。
正文 · 原文
Abstract:Distributed agent workflows cache delegated authority at tool gateways. Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped. We define C0-C5, a bounded outcome contract spanning issuer commit through effect prevention, and implement it as a persistent monitor over a frozen gateway set, call set, and observation window. A 14-case fault matrix checks conservative classification, sticky violations, restart persistence, and evidence immutability. In a derived audit of its eight semantic cases, treating C3 or C4 as completion produces seven or five false positives, respectively; the bounded C0-C5 verdict produces none. Descriptive scaling covers 1,024 gateways and 10,000 effect vectors. The primary experiment uses the maintained Keycloak 26.7 identity server and measures the contract across two durable receivers, eight physical agent-tool gateways, Filesystem and PostgreSQL effects, and 16 AWS hosts in three availability zones. Normal delivery and recovery commit no effects. Under receiver-selective non-delivery, transport acknowledgment and receiver persistence still succeed, but 112 of 225 calls (49.78%) are admitted, and all 112 effects commit in every treatment block. A separately provisioned execution repeats the result. OPA/Toxiproxy and a live three-role LLM workflow with networked MCP tools reproduce the persisted-but-not-enforced boundary on narrower surfaces. Finally, an unmodified external MCPMark agent executes 60 closed-loop task arms. Normal C4 denies all 31 exposed post-barrier calls and commits no effect; selective C3 allows 344 calls and commits 145 effects across Filesystem and PostgreSQL. Transport success is therefore evidence of progress, not a revocation-completion verdict.
| Subjects: | Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2610.15991 [cs.AI] |
| (or arXiv:2610.15991v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.15991 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Lifei Liu [view email]
[v1]
Sun, 11 Oct 2026 23:41:18 UTC (137 KB)
来源：arXiv cs.AI · arxiv.org