Programmable Authorization Computation

Updated 12 July 2026

Programmable authorization computation is a paradigm where authorization decisions are derived dynamically from structured inputs such as policies, context, and proofs.
It integrates formal logics, zero-knowledge proofs, and runtime predicates to provide verifiable and efficient authorization in distributed systems.
This approach ensures robust security properties including noninterference, proof-derived authority, and streamlined execution gating.

Searching arXiv for recent work on programmable authorization computation and related authorization formalisms. I’m checking arXiv records relevant to programmable authorization computation, including agentic authorization, zero-knowledge authorization, and formal authorization logic. Programmable authorization computation denotes a family of mechanisms in which authorization is treated as an explicit computation over structured inputs—such as policy, context, provenance, proofs, replay state, delegation chains, or consent boundaries—rather than as a static consequence of identity possession, a broad operator scope, or a bare signature artifact. In the literature, this shift appears in formal authorization logics, information-flow calculi, blockchain authorization layers, consent middleware for tool-using models, task-scoped agent protocols, proof-derived infrastructure control, and compliance-mediated payments. The common pattern is that execution is gated by the result of a verifiable authorization procedure, and the inputs to that procedure are often made durable, auditable, or replayable (Arden et al., 2021, Wang, 9 Mar 2026, He et al., 13 May 2026).

1. From authorization logic to computed authority

Early formal work already treated authorization as something that can be derived rather than merely looked up. Nexus Authorization Logic models authorization in distributed systems as a constructive first-order multimodal logic in which principals, affirmations, delegation, and restricted delegation are first-class formula constructors. Its stated use cases include axiomatic authorization, synthetic authorization, and analytic authorization, and the revised NAL $_1$ makes delegation primitive, adopts localized hypotheses, and provides a new Kripke semantics with a Coq-formalized soundness result (Hirsch et al., 2012).

FLAC pushes the same idea into a programming-language setting. It treats authorization as dynamic computation over evidence and integrates that computation with information-flow control, so that a program may derive new trust relations and relabel data only when the current computation is sufficiently trusted. In FLAC, delegation values are first-class terms, assume extends the delegation context during typing and evaluation, and the security theorems target noninterference and robust declassification for programs that implement rich dynamic authorization mechanisms (Arden et al., 2021).

Recent systems generalize this computational view into operational architectures. In these papers, the decisive question is not simply whether a caller is authenticated, but whether a specific action is justified by a structured authorization object or by a runtime predicate over state. This suggests a unifying interpretation: programmable authorization computation is less a single protocol than a design stance in which authorization is encoded as a verifiable program, relation, proof, lattice query, or symbolic derivation.

2. Authorization objects and execution gates

Across the literature, the computational core is carried by an explicit authorization object. The object differs by domain, but it is always narrower and more structured than a standing privilege.

System	Authorization object	Execution criterion
NAL	`\#\tau.\phi`, delegation formulas	Derivability in the proof system
FLAC	Delegation values, `assume`	Typable, flow-limited computation
PAuth	NL slices, envelopes	Call matches task-derived symbolic computation
ConLeash	Boundary $\varphi=(l_i,l_o,\tau,E)$	Subsumed by policy or escalated
DTF	$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$	Consensus approves proof
ZK-ACE	$ID_{com}$ , succinct proof, replay state	Proof verifies and replay checks pass

In NAL, authorization is a logical judgment over formulas such as affirmation and delegation. In FLAC, authorization is represented by delegation values of type $\aftype{p}{q}$ and is constrained by the information-flow context. In PAuth, the authorization object is a per-service symbolic slice extracted from a natural-language task, combined with signed envelopes that bind concrete values to symbolic provenance. In ConLeash, the object is a boundary summarizing source scope, sink scope, taint, and effect set. In DTF, the object is a Justification Proof that fixes the admissibility basis of an action. In ZK-ACE, the object is an identity-bound zero-knowledge authorization statement anchored by an on-chain identity commitment and replay-prevention state (Sharma et al., 17 Mar 2026, Li et al., 12 May 2026, He et al., 13 May 2026, Wang, 9 Mar 2026).

This variety is substantive. A signature, role, or token may still appear, but it no longer exhausts the authorization basis. The object to be checked now includes computational structure: path conditions, context consistency, taint propagation, quorum state, or policy attestations.

3. Formal structures for computing authorization

A notable feature of programmable authorization computation is that the authorization decision is given a formal semantics rather than being left as an implementation convention. NAL supplies constructive Kripke semantics over worlds, principals, and accessibility relations, with formulas for affirmation, delegation, and restricted delegation. Its soundness theorem states that if $\Gamma \vdash \phi$ and every formula in $\Gamma$ holds in a model, then $\phi$ holds in that model, thereby making authorization derivations semantically checkable (Hirsch et al., 2012).

FLAC provides a typed operational account. Its typing judgment $\TVal{\Pi;\Gamma;\pc}{e}{\tau}$ tracks a delegation context $\Pi$ , variable context $\varphi=(l_i,l_o,\tau,E)$ 0, and information-flow context $\varphi=(l_i,l_o,\tau,E)$ 1. The central mechanism is that assume extends the delegation context only when integrity and confidentiality side conditions hold, so dynamic authority computation is permitted but confined. The language proves noninterference and robust declassification, which addresses a central risk in dynamic authorization: that attackers might influence the computation that decides what is authorized or disclosed (Arden et al., 2021).

Several 2026 systems present domain-specific formalisms of the same general kind. ConLeash defines authorization as containment in a product lattice. A call boundary is

$\varphi=(l_i,l_o,\tau,E)$ 2

and subsumption is

$\varphi=(l_i,l_o,\tau,E)$ 3

The decision procedure then operates on the tagged upper set, the frontier of minimal covering rules, and a solver predicate $\varphi=(l_i,l_o,\tau,E)$ 4 that returns either a unique action or $\varphi=(l_i,l_o,\tau,E)$ 5, meaning “ask the user” (Li et al., 12 May 2026).

PAuth formalizes server-side authorization as symbolic slice compilation plus runtime provenance checking. A slice is a symbolic specification of the call a service expects, including let bindings and assert clauses, and Algorithm 1 compiles the slice AST into allowed_calls, arg_exprs, guards, let_defs, and cross_service_deps. The runtime proof obligation is essentially that the concrete argument equals evaluation of the symbolic argument expression under verified envelopes, and that the symbolic provenance belongs to the task-derived slice (Sharma et al., 17 Mar 2026).

The compositional governance framework overlays agentic semantics onto an existing ReBAC policy using a typed graph rewrite

$\varphi=(l_i,l_o,\tau,E)$ 6

so that authorization becomes the union of original domain permission and an agent branch obtained by intersecting scope membership with delegation reachability. The central pattern is:

$\varphi=(l_i,l_o,\tau,E)$ 7

The framework proves a conservative extension lemma for domain principals and an agent authorization soundness theorem grounded in human-rooted delegation and valid scope (Ibrahim et al., 2 Jun 2026).

4. Cryptographic and verifiable authorization layers

In cryptographic systems, programmable authorization computation often appears as a rejection of signature-centric validation. ZK-ACE states that blockchain consensus does not fundamentally need a signature object; it needs a proof that “this transaction was authorized by the correct identity under the protocol rules.” The construction replaces transaction-carried signature objects with identity-bound zero-knowledge authorization statements, using a deterministic identity derivation primitive, an on-chain identity commitment

$\varphi=(l_i,l_o,\tau,E)$ 8

and replay-prevention state. The circuit proves commitment consistency, deterministic derivation correctness, authorization binding to the transaction hash, anti-replay, and domain/context consistency. The paper formalizes authorization soundness, replay resistance, substitution resistance, and cross-domain separation with reduction-based proofs under knowledge soundness, collision resistance, and DIDP identity-root recovery hardness (Wang, 9 Mar 2026).

DTF makes a similar move for sovereign AI infrastructure. It computes authority from a structured proof:

$\varphi=(l_i,l_o,\tau,E)$ 9

where

$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 0

Independent evaluators produce attestations $JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 1, a consensus function returns $JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 2, and only approval permits derivation of an ephemeral Execution Identity

$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 3

subject to

$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 4

The evidence chain

$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 5

records the entire lifecycle, and the paper states the invariant: “No high-stakes execution without proof, no authority without consensus, and no valid mutation detached from evidence” (He et al., 13 May 2026).

Threshold Authorization Without Threshold Signatures separates member authentication from threshold authorization. Members sign approval envelopes under any EUF-CMA-secure signature scheme, but the threshold property is realized by a seal reconstructed from Shamir-shared secrets, with the base policy instantiated as an affine map

$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 6

The verifier checks member signatures, share openings, interpolation consistency, and slot freshness. The paper explicitly frames the seal as the base instance of a programmable authorization computation, with richer policies permitted over secret-shared state while keeping the member-signature scheme outside that computation (Porechna, 9 Jul 2026).

Compliance-aware agentic payments preserve signature-based authorization but subordinate execution to policy computation. A buyer creates a signed payment authorization, a compliance agent relays it into a PolicyWrapper, and the GL1 programmable compliance layer returns PASS, FAIL, or PENDING. Authorization therefore means “is the signed payment instruction authorized under the current compliance rules right now?” rather than merely “did the buyer sign?” In PENDING cases, no settlement occurs; instead, a transaction-linked attestation is recorded on-chain, and later evidence can complete authorization and release escrow (See et al., 30 Apr 2026).

In agentic settings, programmable authorization computation addresses the mismatch between broad permissions and narrow task intent. PAuth argues that operator-scoped authorization, exemplified by OAuth, is misaligned with natural-language tasks because it authorizes classes of operations rather than the concrete operations implied by faithful execution. Its answer is Precise Task-Scoped Implicit Authorization: each server derives a symbolic call specification from the task, and each runtime operand must be justified by signed provenance. In AgentDojo, the reported result is 0 false positives and 0 false negatives across 100 benign tasks and 634 forced-injection attack runs, with benign tasks completing successfully and attack runs detected as permission violations (Sharma et al., 17 Mar 2026).

ConLeash addresses a different agentic problem: consent fatigue in Model Context Protocol deployments. It makes authorization boundary-scoped by abstracting each tool call as

$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 7

or equivalently $JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 8, and then deciding whether the boundary is covered by prior consent, blocked by a non-overridable invariant, or ambiguous and therefore escalated. On 984 traces comprising 3,538 tool-call steps, it reports 98.2% step accuracy, F1 = 98.7%, precision 97.9%, recall 99.4%, auto-permitted 98.3% of benign invocations, caught 99.4% of escalations, and 8.2 ms reasoning overhead per step. In a within-subject study with 16 participants, 15 of 16 preferred ConLeash, and all 16 trusted ConLeash over LLM-based auto-consent (Li et al., 12 May 2026).

Chain-of-Authorization internalizes authorization into the model’s reasoning trajectory itself. It reforms the input as

$JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ 9

and trains the model to generate a trajectory

$ID_{com}$ 0

before the answer, with joint generation

$ID_{com}$ 1

The underlying policy is a set-inclusion test,

$ID_{com}$ 2

but the distinctive claim is that the model learns to execute this policy as a causal prerequisite for response generation. The paper reports near-SFT performance on authorized tasks, while in unauthorized settings CoA drives accuracy near zero and refusal rates near 100%, and keeps attack success rates near zero in the reported adversarial experiments (Li et al., 24 Mar 2026).

The compositional governance framework extends the same theme to recursive delegation and scope. It treats delegation as a contractual relation, scope as a contextual envelope, and final permission as the union of existing human authorization and delegated agent permission. This is not task-scoped in the PAuth sense or trajectory-scoped in the CoA sense; it is graph-compositional and domain-agnostic, intended to overlay agentic semantics onto pre-existing authorization schemas (Ibrahim et al., 2 Jun 2026).

6. Security properties, efficiency claims, and recurring limitations

The literature repeatedly recasts authorization correctness in security terms. ZK-ACE formalizes authorization soundness, replay resistance, substitution resistance, and cross-domain separation. DTF adds lifecycle constraints of proof-bound execution, consensus-gated authority, non-escalation, and evidence completeness. Threshold authorization states I0 Threshold authorization, I1 Threshold secrecy, I2 Per-operation binding, and I3 Member attribution. The compositional overlay proves that authorized agent access implies a human root, a valid delegation path, and a scope witness. FLAC proves noninterference and robust declassification, while NAL proves soundness of derivations under its Kripke semantics (Wang, 9 Mar 2026, He et al., 13 May 2026, Porechna, 9 Jul 2026, Ibrahim et al., 2 Jun 2026, Arden et al., 2021, Hirsch et al., 2012).

Efficiency claims are similarly tied to explicit computational structure. ZK-ACE gives a structural byte-count comparison rather than a benchmark: direct ML-DSA authorization data is roughly $ID_{com}$ 3 bytes per transaction, whereas the ZK-ACE model is approximately $ID_{com}$ 4 bytes, yielding about a 10–20× reduction in consensus-visible authorization data. Its circuit is estimated at roughly 1,100–1,400 R1CS constraints, or 1,400–1,800 with extra encoding overhead, and the paper contrasts this with lattice-signature verification inside ZK, which it argues would require millions of constraints. The compositional overlay reports memory ratio bounded roughly in [0.95, 1.2], median check latency under 7 ms in the largest Drive case, and write medians in the range 4.49 ms to 9.42 ms (Wang, 9 Mar 2026, Ibrahim et al., 2 Jun 2026).

Several recurring misconceptions are explicitly challenged. One is that verifying signatures inside a zero-knowledge circuit changes the authorization model; ZK-ACE argues that it merely relocates verification cost while preserving a signature-centric architecture. Another is that tool identity is an adequate unit of consent; ConLeash argues that a single tool can span benign and dangerous argument regions. A related misconception is that a valid caller identity is an adequate basis for autonomous execution; DTF argues that the source of authority must be proof-derived and bounded per decision, while PAuth argues that operator-scoped permissions remain overprivileged even when statically fine-grained (Wang, 9 Mar 2026, Li et al., 12 May 2026, He et al., 13 May 2026, Sharma et al., 17 Mar 2026).

The limitations are heterogeneous and domain-specific. ZK-ACE treats compromise of the underlying identity root as out of scope and requires deployment alignment between the in-circuit Derive and the off-chain DIDP. PAuth does not solve natural-language ambiguity, assumes an authentic UI and TLS-secured communication, and is evaluated in a relatively “closed world.” ConLeash attributes its main errors to LLM predicate extraction noise and DSL expressiveness limits. NAL’s Coq formalization was incomplete for delegation and restricted delegation, with group principals identified as an open technical complication. These caveats suggest that programmable authorization computation is powerful precisely because it shifts authorization into richer computation, but that shift also makes semantics, compiler correctness, provenance integrity, and evidence management part of the trusted base (Wang, 9 Mar 2026, Sharma et al., 17 Mar 2026, Li et al., 12 May 2026, Hirsch et al., 2012).