Execution-Time Authorization for AI Agents formalizes execution-time authorization (ETA) as a deterministic governance boundary for AI agents and other autonomous systems whose proposed actions may produce real-world effects. The paper defines ETA as a pre-execution enforcement layer that evaluates canonicalized action instances against versioned policy and governed system state before execution, producing a replayable authorization verdict and a tamper-evident, independently reconstructable authorization artifact. The paper distinguishes ETA from adjacent categories often mistaken for governance enforcement, including guardrails, alignment techniques, identity and access management, observability tooling, agent orchestration, and policy engines. It argues that these systems may provide useful safety, visibility, policy-evaluation, or coordination functions, but do not by themselves constitute execution-time authorization unless they operate at a non-bypassable runtime boundary, fail closed absent an affirmative ALLOW verdict, and produce an authorization artifact sufficient for independent verdict reconstruction. Version 2.1 expands the February 2026 release by adding a structured relationship to access-control and policy-engine prior art, including the reference-monitor tradition, complete mediation and fail-safe defaults, XACML PDP/PEP architecture, OPA/Rego, Cedar, Zanzibar, and proof-carrying code. The paper narrows the novelty claim accordingly: ETA does not claim to invent access mediation, policy decision points, or proof-carrying evidence. It defines a specific architectural composition: a runtime authorization boundary that holds a concrete action instance before execution, binds the verdict to policy, state, and canonical action representation, fails closed under missing authorization, and emits an authorization artifact suitable for replay. This version also introduces a state-freshness and release-binding invariant. A conforming ETA implementation must address time-of-check-to-time-of-use risk by ensuring that the governed state has not changed in a governance-relevant way between authorization and release, and by verifying that the action released for execution is byte-equivalent, hash-equivalent, or otherwise canonically equivalent to the action authorized. A matching conformance test is added. The formal model specifies the authorization function, verdict semantics, determinism requirement, canonicalization requirement, fail-closed behavior, non-bypassability, authorization artifact completeness, replayability, time-bounded evaluation without fail-open behavior, and state-freshness / release-binding requirements. The verdict space is ALLOW, DENY, and ABSTAIN; ABSTAIN blocks execution pending authorized human override. The paper aligns the ETA framework with the Five Tests Standard (5TS): Stop, Ownership, Replay, Escalation, and Provenance. It treats Proof-Carrying Decisions (PCDs) as an implementation form of the authorization artifact, not as a replacement for the canonical authorization-artifact vocabulary. Version 2.1 corrects citation alignment, clarifies canonicalization equivalence, tightens the 5TS and prior-art treatment, and preserves the core analytical position of the original February 2026 release while extending the formal framework to address state freshness and release binding.
Edward Meyman (Sun,) studied this question.