Revocation in decentralized, multi-hop agent delegation chains

Develop mechanisms to propagate revocation reliably across decentralized, multi-hop agent delegation chains that use offline-attenuated tokens such as Biscuits and Macaroons, ensuring timely termination of delegated authorities throughout the entire delegation path from the original user to all downstream sub-agents.

Background

The paper highlights that revocation is a critical and largely unsolved problem when agents delegate authority across chains, particularly in decentralized architectures using offline-attenuated, object-capability style tokens (e.g., Biscuits and Macaroons). In such systems, sub-tokens can be derived without contacting the original issuer, making traditional centralized revocation difficult to propagate along the delegation path.

The authors note that if a user revokes a primary agent’s access, there is no clear immediate mechanism to propagate that revocation down a chain of offline tokens already further delegated. They discuss emerging standards like the Shared Signals Framework and OpenID Provider Commands as potential building blocks, and suggest bounding credentials by execution counts as a mitigation, but emphasize that a comprehensive, timely revocation solution remains unresolved.

References

A critical, and largely unsolved, problem in these architectures is revocation. In a decentralized system using offline-attenuated tokens, the problem is magnified.

— Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world  (2510.25819 - South et al., 29 Oct 2025) in Section 3, Delegated Authorization and Transitive Trust — The Revocation Challenge

Four open problems bound what the framework can currently guarantee. Sensor-manipulation adversaries who target both V2X messages and the physical observations used to validate them can evade Tier 1 cross-modal reasoning - closing this gap requires hardware-rooted sensor attestation that current automotive standards do not yet specify. Certificate propagation latency creates a revocation window that behavioral flagging only partially closes, and resolving it requires changes at the SCMS standards level rather than the detection layer.

— Autonomous Cyber Defense in Connected Vehicles: A Multi-Agent Approach to V2X Security  (2608.19135 - Medam, 19 Aug 2026) in Section VI.B, “Certificate Propagation Latency and the Revocation Gap”; Section VII conclusion

A deployment would have to separate the adversary's windows from ordinary ones, and \S\ref{sec:couple} explains why we do not know how to do that without giving the adversary something to learn.

— Provisional Reachability: Containing Agents by Making Every Crossing Revocable  (2609.21957 - Takashita, 18 Sep 2026) in Section 8, “Putting it together: how much is actually stopped” (discussion of the integrated experiment); also Section 6.2, “Splitting the window by principal”

Defense work on Agentic JWT and SentinelAgent begins to address multi-hop delegation, but preserving intent, scope, and provenance across semantic transformation, and revoking authority after credentials, capabilities, or state have already propagated, remain open challenges.

— SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems  (2609.00595 - Yang et al., 1 Sep 2026) in Section 4, subsection P7, “Delegation and authority escalation”