Agent Authority Lab

Reproducible authority-boundary cases for tool-using AI systems.

This repository tests a narrow security question: if untrusted retrieved content has already influenced an agent's proposed transaction, can a separate authority layer prevent that proposal from becoming an authorized action?

The first case models recipient substitution. A synthetic external document causes an agent proposal to replace an allowed treasury address with an untrusted address. The policy layer evaluates the resulting proposal independently of the agent's rationale.

User intent + untrusted retrieved content
                    |
                    v
        potentially compromised proposal
                    |
                    v
 recipient policy + amount limit + approval binding
                    |
              authorize / reject

Case 001: Recipient substitution

The committed case exercises four paths:

Path	Result	Evidence
Untrusted recipient, no approval	Rejected	recipient_not_allowed, approval_missing
Untrusted recipient, self-approval from retrieved content	Rejected	recipient_not_allowed, approver_not_authorized
Allowed recipient, authorized approval bound to exact intent	Authorized	No rejection reasons
Amount changed after approval	Rejected	approval_digest_mismatch

The intent digest is SHA-256 over canonical JSON containing chain_id, asset, recipient, and amount. Approval is valid only for that exact digest.

See the case report and canonical trace.

Run the case

Requirements:

• Python 3.11 or newer.

git clone https://github.com/VolodymyrStetsenko/agent-authority-lab.git
cd agent-authority-lab
python3 -m venv .venv
.venv/bin/python -m pip install -e '.[dev]'
.venv/bin/pytest -q
.venv/bin/agent-authority-case \
  --output evidence/recipient-substitution-001/trace.json

The command prints the same canonical trace to stdout. Repeated runs are byte-for-byte deterministic.

Security claim

Within this synthetic policy model, a recipient outside the configured allowlist is rejected, content cannot approve its own proposal, and an approval cannot be reused after the approved intent changes.

The control is placed after proposal generation because agent behavior and retrieved context are treated as untrusted inputs. Authorization is a separate decision.

Explicit limitations

This repository does not:

• call a language model or measure prompt-injection success rates;
• connect to a wallet, private key, signer, RPC endpoint, or blockchain;
• execute, simulate, or protect a real transaction;
• authenticate a human approver;
• establish that an allowlist or policy source is correct;
• cover tool isolation, memory poisoning, data exposure, code execution, or multi-agent coordination;
• provide a production transaction-policy library;
• replace a security review of the complete agent, identity, tool, and execution architecture.

A compromised policy store, approver identity, signer, deployment process, or enforcement integration remains outside this case.

Repository structure

src/agent_authority_lab/       Policy model, case runner, and CLI
tests/                         Control and determinism tests
evidence/                      Committed canonical trace and case report
docs/threat-model.md           Assets, trust boundaries, and exclusions
.github/workflows/ci.yml       Reproduction across supported Python versions

Engagement context

Agent Authority Lab is public research evidence from Volodymyr Stetsenko's security practice. It demonstrates one review method: assume agent output may be compromised, then test whether consequential authority is independently constrained.

For a defined agentic-systems security review, see the engagement model.

License

Apache License 2.0. See LICENSE.