The Authorization Gap Has a Literature Now

For a year the argument was that agent authority needs a decision at runtime, not a check at the start. The research has caught up, proved the sharp version, and drawn a clear line around what nobody has solved.

Every agent action carries an implicit claim. This principal may perform this operation on this target, right now, under current policy and current standing. Authentication checks who is asking. Detection checks whether the trace looked wrong after it ran. The claim in the middle, whether the action was allowed at the moment it fired, is the Authorization Gap. For most of the last year it lived in blog posts and conference talks rather than in proofs.

That has changed. A cluster of papers published between late 2025 and mid 2026 has formalized the problem, and the formal version is sharper than the essays were.

What the research settled

A May 2026 paper from Kamiwaza AI gives the gap a formal name, authorization propagation, and splits it into three sub-problems. Transitive delegation, meaning what authority an agent inherits when it acts for another. Aggregation inference, meaning whether a result synthesized from individually allowed sources is itself allowed. Temporal validity, meaning whether a decision made when a workflow started still holds when a later step runs.

The same paper reports something more useful than the theory. In a real production system, authorization boundaries broke on their own, with no attacker present. A session that lost its workspace binding silently widened to a global scope. A delegation that failed was reported to the caller as successful. These are not exotic exploits. They are ordinary engineering under load, drifting into states where an agent held authority it was never granted.

The most decisive result is narrower and harder to argue with. A companion analysis maps the problem to cache coherence, the discipline processors use to keep many copies of memory consistent, and proves that time-based expiry is the wrong primitive for agent authority. When permission is a token with a lifetime, the count of unauthorized actions scales with how fast the agent runs multiplied by how long the token lives. A faster agent burns through more stale-authority actions before expiry catches up. Checking validity by execution count rather than by the clock bounds the damage regardless of speed. Stated plainly, the industry default of short-lived tokens does not degrade gently at machine speed. It degrades in proportion to velocity.

This is the affirmative case for what the practitioner argument kept asserting. Authority has to be evaluated at the action, against live state, and time-boxing is not a substitute for that.

What the research left open

The papers are candid about their own boundary, and the boundary is the whole opportunity.

Each result solves a fragment. One mechanism does per-hop delegation with attenuation. Another derives task scope from the request. Another tracks causal dependencies to catch aggregation. Another does verified revocation. The authors say directly that no single mechanism satisfies the full set of requirements, and that composing them into one architecture without introducing new failure modes is an open question. Aggregation inference, the read-side case where allowed pieces combine into a disallowed whole, they call unsolved in the general case.

The sharpest open edge is latency across systems. The best formally verified revocation in the literature lands in about a second. Inside one protocol, on one substrate, that is a strong result. For a payment or any irreversible action at machine speed, a second is a long time, and real deployments are never one substrate. They are a dozen systems that do not share a clock, each holding its own copy of who may do what. A revocation is worth something only if it reaches the place the next action fires before that action fires. Closing that distance across heterogeneous production systems is the part no paper closes, because at that point it stops being a proof and becomes an engineering problem about propagation.

Why fragments do not add up on their own

The pattern is familiar to anyone who watched enterprise data governance. Master data management tried to solve consistency by naming one authoritative copy, and the copy drifted the moment the world moved. The lesson was that authority resolved from many live sources beats authority mastered in one place and left to age.

Agent authorization is arriving at the same fork. The fragments in the literature each master one slice of the decision. A working system has to federate them at runtime, resolve the current answer across the delegation chain and the systems of record at the moment of the action, and carry a revocation to every one of them fast enough to matter. That requires a different architecture, not a longer-lived token.

What to take from it

For builders, the research is a gift and a warning. It ends the argument about whether runtime authorization is necessary, so nobody has to relitigate that. It also marks the exact places where a demo passes and a production system does not, at composition and at cross-system propagation. Build to the fragments and the demo works. Ship to real systems and the distance between one-second revocation and machine-speed action is where the incidents live.

For buyers, the question sharpens. Runtime authorization is now table stakes, so the real question is how a revocation reaches every system an agent touches, and how long that takes. Ask for the number. If the answer is a token lifetime, the literature has already shown how that scales.

The Authorization Gap is no longer a claim that needs defending. It is a named research area with proofs attached. The open problem is the one that was always going to be hardest, and the one a paper cannot finish.

Deciding correctly at the moment of action, across every system at once, before the next action runs.

Cross-link: this piece names academic backing for the coinage in N° 020 (The Authorization Gap) and consolidates the research position of the runtime-authorization arc. Direct extension of N° 029 (Detection Is Downstream of Authorization) on the at-the-moment-of-action requirement and N° 030 (A Signature Is Not a Premise) on the failure mode inside signed records. Companion in spirit to N° 018 (The Question No One Signed) on the accountability parallel. Three primary academic sources verified against arXiv listings: Tallam (Kamiwaza AI), "Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure," arXiv:2605.05440, May 6, 2026, which coins "authorization propagation," identifies the three sub-problems (transitive delegation, aggregation inference, temporal validity), and reports production drift observations; Parakhin, "The Bureaucracy of Speed: Structural Equivalence Between Memory Consistency Models and Multi-Agent Authorization Revocation," arXiv:2603.09875, March 2026, which proves the cache-coherence mapping and the machine-speed failure of time-based token expiry; Chen (University of Macau), "AITH: A Post-Quantum Continuous Delegation Protocol for Human-AI Trust Establishment," arXiv:2604.07695, April 9, 2026, which specifies the six-check Boundary Engine and push-based revocation within one second, machine-verified via the Tamarin Prover. The "fail-and-report" pattern named in the research is Tallam's coinage; Chen's AITH implements the pattern without using the term. Strategic framing note: "the Authorization Gap" is retained as the practitioner umbrella term for what the academic literature calls "authorization propagation"; the two are mapped rather than competed. Reciprocal: FederatedIQ operationalizes the cross-system runtime resolution the literature identifies as the open engineering problem at federatediq.ai.