---
title: Programmable Authorization Computation
url: https://www.emergentmind.com/topics/programmable-authorization-computation
type: topic
---

# Programmable Authorization Computation

Searching arXiv for recent work on programmable authorization computation and related authorization formalisms.
I’m checking arXiv records relevant to programmable authorization computation, including agentic authorization, zero-knowledge authorization, and formal authorization logic.
Programmable authorization computation denotes a family of mechanisms in which authorization is treated as an explicit computation over structured inputs—such as policy, context, provenance, proofs, replay state, delegation chains, or consent boundaries—rather than as a static consequence of identity possession, a broad operator scope, or a bare signature artifact. In the literature, this shift appears in formal authorization logics, information-flow calculi, blockchain authorization layers, consent middleware for tool-using models, task-scoped agent protocols, proof-derived infrastructure control, and compliance-mediated payments. The common pattern is that execution is gated by the result of a verifiable authorization procedure, and the inputs to that procedure are often made durable, auditable, or replayable [2104.10379] [2603.07974] [2605.15228].

## 1. From authorization logic to computed authority

Early formal work already treated authorization as something that can be derived rather than merely looked up. Nexus Authorization Logic models authorization in distributed systems as a constructive first-order multimodal logic in which principals, affirmations, delegation, and restricted delegation are first-class formula constructors. Its stated use cases include **axiomatic authorization**, **synthetic authorization**, and **analytic authorization**, and the revised NAL\(_1\) makes delegation primitive, adopts localized hypotheses, and provides a new Kripke semantics with a Coq-formalized soundness result [1211.3700].

FLAC pushes the same idea into a programming-language setting. It treats authorization as **dynamic computation over evidence** and integrates that computation with information-flow control, so that a program may derive new trust relations and relabel data only when the current computation is sufficiently trusted. In FLAC, delegation values are first-class terms, `assume` extends the delegation context during typing and evaluation, and the security theorems target noninterference and robust declassification for programs that implement rich dynamic authorization mechanisms [2104.10379].

Recent systems generalize this computational view into operational architectures. In these papers, the decisive question is not simply whether a caller is authenticated, but whether a specific action is justified by a structured authorization object or by a runtime predicate over state. This suggests a unifying interpretation: programmable authorization computation is less a single protocol than a design stance in which authorization is encoded as a verifiable program, relation, proof, lattice query, or symbolic derivation.

## 2. Authorization objects and execution gates

Across the literature, the computational core is carried by an explicit authorization object. The object differs by domain, but it is always narrower and more structured than a standing privilege.

| System | Authorization object | Execution criterion |
|---|---|---|
| NAL | `\#\tau.\phi`, delegation formulas | Derivability in the proof system |
| FLAC | Delegation values, `assume` | Typable, flow-limited computation |
| PAuth | NL slices, envelopes | Call matches task-derived symbolic computation |
| ConLeash | Boundary $\varphi=(l_i,l_o,\tau,E)$ | Subsumed by policy or escalated |
| DTF | $JP_t=(M_t,S_t,\Pi_t,R_t,B_t)$ | Consensus approves proof |
| ZK-ACE | $ID_{com}$, succinct proof, replay state | Proof verifies and replay checks pass |

In NAL, authorization is a logical judgment over formulas such as affirmation and delegation. In FLAC, authorization is represented by delegation values of type $\aftype{p}{q}$ and is constrained by the information-flow context. In PAuth, the authorization object is a per-service symbolic slice extracted from a natural-language task, combined with signed envelopes that bind concrete values to symbolic provenance. In ConLeash, the object is a boundary summarizing source scope, sink scope, taint, and effect set. In DTF, the object is a Justification Proof that fixes the admissibility basis of an action. In ZK-ACE, the object is an identity-bound zero-knowledge authorization statement anchored by an on-chain identity commitment and replay-prevention state [2603.17170] [2605.11360] [2605.15228] [2603.07974].

This variety is substantive. A signature, role, or token may still appear, but it no longer exhausts the authorization basis. The object to be checked now includes computational structure: path conditions, context consistency, taint propagation, quorum state, or policy attestations.

## 3. Formal structures for computing authorization

A notable feature of programmable authorization computation is that the authorization decision is given a formal semantics rather than being left as an implementation convention. NAL supplies constructive Kripke semantics over worlds, principals, and accessibility relations, with formulas for affirmation, delegation, and restricted delegation. Its soundness theorem states that if $\Gamma \vdash \phi$ and every formula in $\Gamma$ holds in a model, then $\phi$ holds in that model, thereby making authorization derivations semantically checkable [1211.3700].

FLAC provides a typed operational account. Its typing judgment $\TVal{\Pi;\Gamma;\pc}{e}{\tau}$ tracks a delegation context $\Pi$, variable context $\Gamma$, and information-flow context $\pc$. The central mechanism is that `assume` extends the delegation context only when integrity and confidentiality side conditions hold, so dynamic authority computation is permitted but confined. The language proves noninterference and robust declassification, which addresses a central risk in dynamic authorization: that attackers might influence the computation that decides what is authorized or disclosed [2104.10379].

Several 2026 systems present domain-specific formalisms of the same general kind. ConLeash defines authorization as containment in a product lattice. A call boundary is
$$
\varphi=(l_i,l_o,\tau,E),
$$
and subsumption is
$$
\varphi \sqsubseteq \varphi' \iff (l_i \sqsubseteq l'_i)\land(l_o \sqsubseteq l'_o)\land(\tau \sqsubseteq \tau')\land(E \sqsubseteq E').
$$
The decision procedure then operates on the tagged upper set, the frontier of minimal covering rules, and a solver predicate $\Psi_\pi(\varphi)$ that returns either a unique action or $\bot$, meaning “ask the user” [2605.11360].

PAuth formalizes server-side authorization as symbolic slice compilation plus runtime provenance checking. A slice is a symbolic specification of the call a service expects, including `let` bindings and `assert` clauses, and Algorithm 1 compiles the slice AST into `allowed_calls`, `arg_exprs`, `guards`, `let_defs`, and `cross_service_deps`. The runtime proof obligation is essentially that the concrete argument equals evaluation of the symbolic argument expression under verified envelopes, and that the symbolic provenance belongs to the task-derived slice [2603.17170].

The compositional governance framework overlays agentic semantics onto an existing ReBAC policy using a typed graph rewrite
$$
C_{D\otimes B}=\mathsf{Overlay}(C_D,\mu),
$$
so that authorization becomes the union of original domain permission and an agent branch obtained by intersecting scope membership with delegation reachability. The central pattern is:
$$
\text{domain permission} \;\cup\; (\text{scope} \cap \text{delegation chain}).
$$
The framework proves a conservative extension lemma for domain principals and an agent authorization soundness theorem grounded in human-rooted delegation and valid scope [2606.03518].

## 4. Cryptographic and verifiable authorization layers

In cryptographic systems, programmable authorization computation often appears as a rejection of signature-centric validation. ZK-ACE states that blockchain consensus does not fundamentally need a signature object; it needs a proof that “this transaction was authorized by the correct identity under the protocol rules.” The construction replaces transaction-carried signature objects with identity-bound zero-knowledge authorization statements, using a deterministic identity derivation primitive, an on-chain identity commitment
$$
ID_{com} = H(REV \| salt \| domain),
$$
and replay-prevention state. The circuit proves commitment consistency, deterministic derivation correctness, authorization binding to the transaction hash, anti-replay, and domain/context consistency. The paper formalizes authorization soundness, replay resistance, substitution resistance, and cross-domain separation with reduction-based proofs under knowledge soundness, collision resistance, and DIDP identity-root recovery hardness [2603.07974].

DTF makes a similar move for sovereign AI infrastructure. It computes authority from a structured proof:
$$
f: \mathcal{I} \times \mathcal{C} \times \mathcal{P} \rightarrow \mathcal{J}, \qquad JP_t=f(I_t,C_t,P_t),
$$
where
$$
JP_t=(M_t,S_t,\Pi_t,R_t,B_t).
$$
Independent evaluators produce attestations $A_t$, a consensus function returns $\{approve,reject,escalate\}$, and only approval permits derivation of an ephemeral Execution Identity
$$
EI_t = h(JP_t, A_t, \Gamma_t),
$$
subject to
$$
Scope(EI_t) \preceq B_t.
$$
The evidence chain
$$
EC_t = (I_t, C_t, P_t, JP_t, A_t, \Gamma_t, D_t, EI_t, X_t, O_t)
$$
records the entire lifecycle, and the paper states the invariant: “No high-stakes execution without proof, no authority without consensus, and no valid mutation detached from evidence” [2605.15228].

Threshold Authorization Without Threshold Signatures separates **member authentication** from **threshold authorization**. Members sign approval envelopes under any EUF-CMA-secure signature scheme, but the threshold property is realized by a seal reconstructed from Shamir-shared secrets, with the base policy instantiated as an affine map
$$
\sigma_\nu = k_1 x + k_2.
$$
The verifier checks member signatures, share openings, interpolation consistency, and slot freshness. The paper explicitly frames the seal as the base instance of a programmable authorization computation, with richer policies permitted over secret-shared state while keeping the member-signature scheme outside that computation [2607.08226].

Compliance-aware agentic payments preserve signature-based authorization but subordinate execution to policy computation. A buyer creates a signed payment authorization, a compliance agent relays it into a PolicyWrapper, and the GL1 programmable compliance layer returns **PASS**, **FAIL**, or **PENDING**. Authorization therefore means “is the signed payment instruction authorized under the current compliance rules right now?” rather than merely “did the buyer sign?” In **PENDING** cases, no settlement occurs; instead, a transaction-linked attestation is recorded on-chain, and later evidence can complete authorization and release escrow [2605.00071].

## 5. Agentic systems, consent, and task-scoped authorization

In agentic settings, programmable authorization computation addresses the mismatch between broad permissions and narrow task intent. PAuth argues that operator-scoped authorization, exemplified by OAuth, is misaligned with natural-language tasks because it authorizes classes of operations rather than the concrete operations implied by faithful execution. Its answer is **Precise Task-Scoped Implicit Authorization**: each server derives a symbolic call specification from the task, and each runtime operand must be justified by signed provenance. In AgentDojo, the reported result is **0 false positives** and **0 false negatives** across **100 benign tasks** and **634 forced-injection attack runs**, with benign tasks completing successfully and attack runs detected as permission violations [2603.17170].

ConLeash addresses a different agentic problem: consent fatigue in Model Context Protocol deployments. It makes authorization boundary-scoped by abstracting each tool call as
$$
\varphi \equiv l_i \xrightarrow{\tau, e*} l_o
$$
or equivalently $\varphi=(l_i,l_o,\tau,E)$, and then deciding whether the boundary is covered by prior consent, blocked by a non-overridable invariant, or ambiguous and therefore escalated. On **984 traces** comprising **3,538 tool-call steps**, it reports **98.2% step accuracy**, **F1 = 98.7%**, **precision 97.9%**, **recall 99.4%**, **auto-permitted 98.3% of benign invocations**, **caught 99.4% of escalations**, and **8.2 ms reasoning overhead per step**. In a within-subject study with **16 participants**, **15 of 16 preferred ConLeash**, and **all 16 trusted ConLeash over LLM-based auto-consent** [2605.11360].

Chain-of-Authorization internalizes authorization into the model’s reasoning trajectory itself. It reforms the input as
$$
X = Prompt_{sys}(C_u, C_g)\oplus Context(E, C_e)\oplus Q
$$
and trains the model to generate a trajectory
$$
T=(T_{res},T_{id},T_{dec})
$$
before the answer, with joint generation
$$
\pi_{\theta}(Y,T\vert X)=\pi_{\theta}(T\vert X)\cdot\pi_{\theta}(Y\vert X,T).
$$
The underlying policy is a set-inclusion test,
$$
\phi(C_{req}, C_u)=
\begin{cases}
1, & \text{if } C_{req}\subseteq C_u\\
0, & \text{otherwise,}
\end{cases}
$$
but the distinctive claim is that the model learns to execute this policy as a causal prerequisite for response generation. The paper reports near-SFT performance on authorized tasks, while in unauthorized settings CoA drives accuracy near zero and refusal rates near 100%, and keeps attack success rates near zero in the reported adversarial experiments [2603.22869].

The compositional governance framework extends the same theme to recursive delegation and scope. It treats delegation as a contractual relation, scope as a contextual envelope, and final permission as the union of existing human authorization and delegated agent permission. This is not task-scoped in the PAuth sense or trajectory-scoped in the CoA sense; it is graph-compositional and domain-agnostic, intended to overlay agentic semantics onto pre-existing authorization schemas [2606.03518].

## 6. Security properties, efficiency claims, and recurring limitations

The literature repeatedly recasts authorization correctness in security terms. ZK-ACE formalizes **authorization soundness**, **replay resistance**, **substitution resistance**, and **cross-domain separation**. DTF adds lifecycle constraints of **proof-bound execution**, **consensus-gated authority**, **non-escalation**, and **evidence completeness**. Threshold authorization states **I0 Threshold authorization**, **I1 Threshold secrecy**, **I2 Per-operation binding**, and **I3 Member attribution**. The compositional overlay proves that authorized agent access implies a human root, a valid delegation path, and a scope witness. FLAC proves noninterference and robust declassification, while NAL proves soundness of derivations under its Kripke semantics [2603.07974] [2605.15228] [2607.08226] [2606.03518] [2104.10379] [1211.3700].

Efficiency claims are similarly tied to explicit computational structure. ZK-ACE gives a structural byte-count comparison rather than a benchmark: direct ML-DSA authorization data is roughly $3{,}732\text{–}7{,}219$ bytes per transaction, whereas the ZK-ACE model is approximately $320\text{–}448$ bytes, yielding about a **10–20× reduction** in consensus-visible authorization data. Its circuit is estimated at roughly **1,100–1,400 R1CS constraints**, or **1,400–1,800** with extra encoding overhead, and the paper contrasts this with lattice-signature verification inside ZK, which it argues would require millions of constraints. The compositional overlay reports memory ratio bounded roughly in **[0.95, 1.2]**, median check latency under **7 ms** in the largest Drive case, and write medians in the range **4.49 ms to 9.42 ms** [2603.07974] [2606.03518].

Several recurring misconceptions are explicitly challenged. One is that verifying signatures inside a zero-knowledge circuit changes the authorization model; ZK-ACE argues that it merely relocates verification cost while preserving a signature-centric architecture. Another is that tool identity is an adequate unit of consent; ConLeash argues that a single tool can span benign and dangerous argument regions. A related misconception is that a valid caller identity is an adequate basis for autonomous execution; DTF argues that the source of authority must be proof-derived and bounded per decision, while PAuth argues that operator-scoped permissions remain overprivileged even when statically fine-grained [2603.07974] [2605.11360] [2605.15228] [2603.17170].

The limitations are heterogeneous and domain-specific. ZK-ACE treats compromise of the underlying identity root as out of scope and requires deployment alignment between the in-circuit `Derive` and the off-chain DIDP. PAuth does **not** solve natural-language ambiguity, assumes an authentic UI and TLS-secured communication, and is evaluated in a relatively “closed world.” ConLeash attributes its main errors to LLM predicate extraction noise and DSL expressiveness limits. NAL’s Coq formalization was incomplete for delegation and restricted delegation, with group principals identified as an open technical complication. These caveats suggest that programmable authorization computation is powerful precisely because it shifts authorization into richer computation, but that shift also makes semantics, compiler correctness, provenance integrity, and evidence management part of the trusted base [2603.07974] [2603.17170] [2605.11360] [1211.3700].

Source: https://www.emergentmind.com/topics/programmable-authorization-computation