Where authority is re-proved: the gap between "allowed" and "done"

Field readings, two of a series. What moved in agent governance between the first week of August and the middle of October 2026, read from five sources. The method is in the previous piece.

What changed

The cluster this topic has been circling all year is admission: who decides that an agent action may happen, and what the decision is allowed to look like. Two arXiv preprints from September, written independently, move the question one step to the right. They are not about whether the action is allowed. They are about the gap between “allowed” and “done”.

Wesley Shu, Boundary-State Control (arXiv:2609.37475, submitted 26 September 2026). The paper names the proposal-to-commit gap and treats it as the time-of-check-to-time-of-use problem for agents. Between the moment a policy says yes and the moment the effect lands, a target can be swapped, an authority revoked, a policy version advanced or an approval gone stale. The mechanism issues a witness bound to the canonical action, to a projection of the authorisation state and to a single-use nonce; at commit it re-canonicalises, recomputes the projection, checks explicit validity predicates, verifies the witness and consumes the nonce atomically with the effect, or withholds the effect. Two outcomes only: commit or withhold. Three details are the useful ones. The security state is factored into six parts: authorisation, authority epoch, procedure evidence, policy identity, approval and request binding, and single-use execution state. Producer-local object identifiers are deliberately not compared, because an earlier version that compared them revoked valid actions whenever equivalent objects were regenerated. And the author says plainly that the cryptography gives tamper evidence only; the contribution is the choice of what must still hold.

Genliang Zhu and Chu Wang, Authorization Revocation for Long-Running Agents (arXiv:2609.21284, submitted 18 September 2026). Stopping an agent is treated as an authorisation problem, not a process-termination one. Authority persists in queued messages, derived credentials, timers, webhooks, reservations and operations a provider has already accepted. A cancellation acknowledgement, a process exit and a revoked token each fail to prove that a retired authority can no longer cause a protected effect. The paper defines root-scoped quiescence: for one authorisation root and one durable cut, no future protected effect can depend on the retired authority, each carrier being terminated, effect-closed, accounted for as committed before the fence, or rebound to an independent witness. The protocol composes signed statements from each sink into a verdict of quiescent, not quiescent, or inconclusive. It explicitly does not mean global idleness, which matters: revoking a shared worker outright would cut off a different root’s legitimate work.

Rohit Krishnan, Strange Loop Canon, 6 October 2026. The empirical companion, in miniature. Five models each wrote and revised a rulebook for households in a sixteen-house town where food is scarce and the score is houses held. Under every framing, every rulebook stole. Removing the score restored nobody’s values; only changing what the score counted ended theft. Restitution deterred only with a catch probability, and the models wrote the expected-value arithmetic in their scratchpads. A public pre-commitment cut theft far more than a private note. A toy world, the author’s own numbers, and the cleanest small demonstration I have seen that a value prompt does not hold against an objective.

Michael Kaplan, The Sentient Architect, 17 September 2026. Ownership of an agent is a decision architecture, not a name in an inventory. Six authorities are routinely bundled and need separating: outcome, platform, identity, acceptance of residual risk, suspension, and whether the investment continues. His test: put the owner in a scenario where value is flowing, security has a material concern, operations cannot absorb an outage and the evidence is incomplete, and ask what happens next.

Marcela Distefano, Ethics, life and AI, 24 July 2026. The OECD, G7 and UK frameworks she reviews carry principles but no quantitative stop rule and no named individual with the authority to halt. Her anchor is the Dutch childcare-benefits scandal, a system nobody had the formal authority, or the will, to stop. Her five questions are a checklist worth keeping: is there a numeric stop rule, a named person who can halt, does it survive a case where stopping costs money, is there post-deployment monitoring, and would it have flagged the benefits case.

Where the sources are thin or wrong

Shu, and Zhu and Wang, are single-author-group preprints with self-built evaluations, not peer-reviewed in the versions read. Several of the revocation paper’s tables were read by caption only, so every rate in both papers is unverified here and none of them transfers. Shu’s witness is a mechanism sketch with a message authentication code, not a signing design anyone should adopt as is. The quiescence protocol presumes provider adapters that can install fences at each sink; most SaaS tools offer no such thing, so the paper reports the shape of the claim, not its feasibility against the providers a municipality actually uses.

Krishnan is one author, five models and a toy world; nothing in it is a rate or a threshold. Kaplan is argument, not measurement, and his vocabulary comes from his own books, which the post promotes. Distefano’s figures for the benefits scandal, about 70,000 families and 2,090 children removed from their homes, are attributed to news reports rather than to primary records, and the framework she proposes in their place is her own and untested. I take the checklist; I do not take the numbers.

What it means

For a CTO. An approval is a contract with a freshness window, not a flag. Bind it to the plan revision, the evidence state and the time it was given; if anything moved, the run asks again. That is what I already do, and these papers say where the check belongs: at the effect, on state read then, not on state the planner remembers. Second, “we revoked the token” is a 200, not a proof. Write down the carriers that can still act after revocation, queues, timers, webhooks, derived credentials, accepted provider operations, and make each one account for itself. The list will be shorter than you fear and longer than your current runbook.

For a municipality. Three things, all organisational before they are technical. Do not ask the prompt to hold the value; decide what the score counts and put the rule outside the model. Name the person who may halt an agent when halting costs money, and write it down before the first case, not after. And separate the six authorities Kaplan lists for every agent that touches a citizen’s file; the one you find bundled is the one that will fail in the review.

Heraclitus said you cannot step into the same river twice. The authorisation state an agent read a second ago is that river, and both papers are about the second step.

Computer says no is at least a verdict. Computer said yes an hour ago is the problem these papers are about.

References

The allusions and quotations in this piece, with their origin, and the sources read:

• Little Britain (BBC, 2003-2006): Carol Beer, “Computer says no.”
• Heraclitus, as reported by Plato, Cratylus 402a: you could not step twice into the same river.
• Wesley Shu, Boundary-State Control for Tool-Using Language-Model Agents: Commit-Time Consistency under State Drift, arXiv:2609.37475, submitted 26 September 2026.
• Genliang Zhu and Chu Wang, Authorization Revocation for Long-Running AI Agents: Root-Scoped Quiescence under Delegation and Asynchronous Execution, arXiv:2609.21284, submitted 18 September 2026.
• Rohit Krishnan, Agent governance looks less like moral education and more like institutional economics, Strange Loop Canon, 6 October 2026.
• Michael Kaplan, Every AI Agent Needs an Accountable Human Owner, The Sentient Architect, 17 September 2026.
• Marcela Distefano, Algorithmic Governance That Doesn’t Govern, Ethics, life and AI, 24 July 2026.