What the Evidence Shows—and What It Does Not
The identity, delegation, and envelope model now has two kinds of support: formal properties of a composed authorization graph and measurements from synthetic workloads. This chapter separates those kinds of evidence. The goal is not to dismiss the design because it is a preprint, or to treat a proof and a benchmark as production validation, but to understand exactly what each supports and what an organization would still need to test.
The proof has a boundary
The compositional framework makes a conservative claim about existing human access. It takes a domain policy, preserves its original human branch, and adds a separate agent branch built from delegation and scope. Under the paper’s applicability conditions, an existing human principal keeps the permission they had before the overlay. The fresh agent branch cannot remove that human permission or change its meaning for the original domain principals.
That is useful because an agent overlay should not quietly rewrite the base authorization system. If a person could view a document before the overlay, the formal preservation property says that adding the agent relationships does not make that person lose the view permission. If the person could not view it, the agent branch cannot gain access simply by being connected to that person through an ill-defined root. The root used to lift the permission must be well typed and no more permissive than the original domain permission.
The guarantee depends on the structure of the composition. The overlay introduces fresh agent, session, and scope types rather than reusing names that already mean something in the domain. Agent principals remain disjoint from the original domain principals. The relationship graph must satisfy the underlying engine’s well-foundedness requirements, and inherited permissions must behave compatibly with the domain hierarchy. These assumptions are what make “preservation” precise. Without them, an overlay could accidentally merge a human and an agent, create a cycle, or lift a permission across a hierarchy that the original policy did not intend.
A second property is human-rooted delegation. If an agent receives a lifted permission through the overlay, the framework says there must be a human principal who holds the corresponding original permission and a valid delegation path from that human to the agent. This does not mean that a human manually approves every individual tool call. It means the agent cannot become the source of its own authority inside the model. Recursive delegation may extend the path, but it still begins at a human root and remains subject to the relationships and conditions that govern each hop.
The third property is the soundness condition for an agent authorization. Three witnesses have to exist together: the human permission on the resource, the valid delegation path to the agent, and a valid session or scope witness for the requested object. The theorem is a formal version of the envelope rule. It does not say that every agent action is wise or that the human intended every generated step. It says that an agent cannot receive the modeled permission unless those three authorization relationships are present.
For an engineering team, this turns a mathematical statement into a set of negative tests. Remove the human permission and confirm that the agent cannot retain the lifted permission through the overlay. Break the delegation chain and confirm that a still-authenticated agent is denied. Keep the chain but remove the session from the resource’s scope and confirm that context closes the path.