Abstract

Why Existing Security Is Not Enough

HTTPS and TLS protect communication channels, OAuth provides delegated access authorization, and identity-management systems authenticate users and workloads. These mechanisms do not, by themselves, guarantee that a particular AI-generated command, API request, transaction, or device operation remains consistent with the exact action authorized by the user or governing policy at the moment of execution.

These mechanisms do not, by themselves, guarantee that a particular AI-generated command, API request, transaction, or device operation remains consistent with the exact action authorized by the user or governing policy at the moment of execution.

This technical disclosure describes a transport-independent, execution-time authorization architecture for autonomous AI agents, enterprise automation, cloud services, network infrastructure, payment systems, and hardware-controlled operations. The architecture introduces independent policy enforcement and exact-operation verification at the boundary where a proposed action would produce an external effect.

The system separates an agent execution environment from protected authorization and enforcement components. An agent may perform reasoning, planning, code execution, tool selection, and request generation within an isolated container, virtual machine, or sandbox, but does not independently control the protected authority required to execute consequential operations.

A proposed action is intercepted before execution and retained in a pending state. An independent policy decision point evaluates the request against the authorized task, principal identity, workload identity, permitted operation, destination, data scope, applicable policy, time limits, revocation status, and execution constraints.

A policy enforcement point at the actual execution boundary independently verifies the pending operation against the approved authorization. Where applicable, authorization is represented by a cryptographically protected, operation-bound, single-use capability. Protected replay state, capability consumption, and atomic verification-and-commit procedures prevent an earlier approval from being reused for a modified, expired, revoked, or previously executed operation.

The central security requirement is that the actual operation presented to the execution boundary must match the authorized operation, not merely carry a valid credential or originate from an authenticated agent.

The architecture supports the following established security functions:

Isolated agent execution and runtime supervision: Agent processes operate within restricted execution environments under process, filesystem, network, and privilege controls. A separately protected supervisor or enforcement service mediates requests that cross the runtime trust boundary.

Centralized policy management with local enforcement: A control-plane service manages security policies, workload identity, authorization state, and configuration updates, while enforcement components apply the applicable policy at individual operation boundaries. Runtime policy changes, revocation, and authorization freshness are evaluated before consequential effects.

Dynamic task-scoped authorization: Agent permissions are constrained by task, permitted resource, operation type, destination, user authority, duration, and current risk conditions. Human approval may supply an additional authorization input but does not replace required execution-time enforcement.

Credential isolation and controlled delegation: API keys, access tokens, and other credentials may remain outside the agent-controlled environment. Credential brokers, secret-management services, and privileged connector processes provide controlled access to external resources. Credential substitution or injection may occur only through an authorized execution path.

Network and application-layer egress control: Outbound requests may be mediated by forward proxies, API gateways, service-mesh components, and policy enforcement services. Authorization checks may evaluate the destination hostname, resolved IP address, port, protocol, HTTP method, request path, payload, workload identity, and permitted data movement before dispatch.

Data provenance and prompt-injection containment: Security controls may track the origin and trust status of data obtained from retrieved documents, websites, external tools, files, and other agents. Provenance and data-flow information participate in authorization decisions to restrict unauthorized tool execution and data exfiltration.

Protected host and operating-system enforcement: System calls, filesystem modifications, browser actions, network connections, and privileged operations may be mediated using operating-system security mechanisms, container-runtime controls, kernel hooks, Linux Security Modules, eBPF, seccomp, hypervisor controls, and protected host services.

Hardware and infrastructure enforcement: Equivalent authorization functions may be implemented at hardware security modules, trusted execution environments, cloud control planes, network processing devices, SmartNICs, data processing units, accelerator controllers, and device interfaces. Applicable protected boundaries may govern GPU/NPU job admission, command submission, memory access, inter-device data transfers, tenant isolation, network transmission, and hardware actuation.

Non-bypassable execution paths: Administrative interfaces, privileged connectors, maintenance channels, alternate network routes, direct device interfaces, and other effect-capable pathways are subject to the applicable enforcement controls. A request cannot obtain execution authority merely by avoiding the primary application gateway.

Unlike authorization models that rely exclusively on an upstream decision, this architecture requires verification of the actual pending operation and current authorization state at the relevant effectuation boundary. Where supported by the implementation, protected state updates and one-time capability consumption are coordinated with the execution commit to mitigate time-of-check/time-of-use vulnerabilities and replay.

The disclosed architecture complements HTTPS, TLS, OAuth, workload identity, zero-trust security, access-control systems, and existing policy engines. It does not require replacing those mechanisms.

Representative applications include autonomous AI agents, coding agents, enterprise assistants, multi-agent systems, Model Context Protocol (MCP) tool execution, cloud infrastructure automation, database modifications, electronic payments, network-function control, telecommunications, industrial automation, and AI computing infrastructure.

The disclosed principle is the separation of permission to compute or request an operation from independently verified authority to make that exact operation effective.

The foundational architecture is described in international patent applications under the Patent Cooperation Treaty, associated with Indian priority filings dating from December 2025.

Full technical specification and independent review package: https://zenodo.org/records/23730224

Filing history. The parent application, PCT/IB2026/055615, was filed on 4 June 2026 and published by WIPO on 16 July 2026 as WO 2026/150382. Its specification runs to 8,598 pages and sets out more than 300 distinct embodiments. It builds on an earlier application covering the Algorithmic Logic Fingerprint (ALF), PCT/IB2026/053385, filed on 7 April 2026 and published on 4 June 2026 as WO 2026/115520. The parent was followed by eight more PCT applications and multiple Indian patent applications, together comprising more than 10,000 pages of non-repetitive disclosure.

Keywords — Patent and Industry Technical Search

Execution-time security: Execution-Time Authorization; Action-Level Authorization; Operation-Level Authorization; Transaction Authorization; Exact-Operation Verification; Intent-to-Execution Binding; Policy Decision Point (PDP); Policy Enforcement Point (PEP); Reference Monitor; Complete Mediation; Enforcement Boundary; Authorization Freshness; Dynamic Authorization; Continuous Authorization; Time-of-Check/Time-of-Use (TOCTOU); Atomic Authorization and Commit; Single-Use Capability; Replay Prevention; Revocation Enforcement; Fail-Closed Security; Non-Bypassable Enforcement.

AI-agent and enterprise security: Agentic AI Security; AI Agent Runtime; Agent Execution Sandbox; Secure Agent Runtime; Agent Supervisor; Agent Security Gateway; Agent Identity; Workload Identity; Least Privilege; Zero Trust; Task-Scoped Permissions; Just-in-Time Access; Dynamic Permissions; Human-in-the-Loop Authorization; Agent Tool Permissions; MCP Tool Authorization; Multi-Agent Delegation; Prompt Injection Mitigation; Untrusted Input Tracking; Data Provenance; Taint Tracking; Data Loss Prevention; Agent Egress Security; Agent Control Plane.

Sandbox, credential, and network enforcement: Container Isolation; MicroVM; Host-Side Enforcement; Runtime Security Policy; Gateway-Supervisor Architecture; Policy-as-Code; Open Policy Agent (OPA); Privileged Connector; Credential Broker; Credential Isolation; Secret Broker; Credential Surrogation; Just-in-Time Credential Injection; API Gateway; Forward Proxy; CONNECT Proxy; Application-Layer Gateway; Layer 4 and Layer 7 Inspection; Egress Filtering; Service Mesh; Sidecar Proxy; eBPF; Linux Security Module (LSM); seccomp; Landlock; System Call Filtering; Host Policy Enforcement; Endpoint Security.

Cloud and hardware enforcement: Cloud Control Plane Security; Cloud Resource Authorization; Confidential Computing; Trusted Execution Environment (TEE); Hardware Security Module (HSM); Hypervisor Enforcement; Hardware Root of Trust; Device Authorization; GPU Workload Isolation; NPU Workload Isolation; Accelerator Job Admission; GPU Command Submission; DMA Protection; SmartNIC; Data Processing Unit (DPU); Network Fabric Security; Multi-Tenant Isolation; Secure Device Access; Protected I/O; Hardware-Enforced Access Control.

Applications and interoperability: HTTPS; TLS; OAuth 2.0; OpenID Connect; OAuth Rich Authorization Requests; DPoP; API Security; Agentic Commerce; AI Agent Payments; Payment Authorization; Database Write Authorization; Data Export Control; Telecommunications Security; 5G Security; 6G Security; Industrial Control Systems; Autonomous Systems; Cyber-Physical Systems; Critical Infrastructure Security.

Suggested IPC Classification Codes

G06F 21/52 — Integrity protection during program execution.

G06F 21/53 — Restricted execution environments, including sandboxes.

G06F 21/60 — Data protection.

G06F 21/62 — Protection of access to data.

G06F 21/64 — Data-integrity protection.

G06F 9/455 — Virtualization arrangements.

H04L 9/32 — Cryptographic verification of identity or authority.

H04L 63/08 — Network entity authentication.

H04L 63/10 — Access control for network resources.

G06Q 20/40 — Payment authorization.

Suggested CPC Classification Codes

Computer and runtime security

G06F 21/52 — Program-execution integrity.

G06F 21/53 — Restricted execution, sandboxing, and secure virtual machines.

G06F 21/54 — Security routines or objects added to programs.

G06F 21/604 — Management of access-control systems.

G06F 21/6218 — Access protection for systems of files or objects, including databases.

G06F 21/6281 — Operating-system-based access protection at execution time.

G06F 21/64 — Data-integrity protection.

Network security and authorization

H04L 63/0807 — Authentication using tickets.

H04L 63/10 — Network-resource access control.

H04L 63/12 — Verification of received information.

H04L 63/20 — Network security management and policies.

H04L 9/3213 — Authentication using tickets or tokens.

H04L 9/3228 — One-time or temporary authentication or authorization information.

Financial and AI applications

G06Q 20/40 — Payment authorization.

G06Q 20/401 — Transaction verification.

G06Q 20/405 — Transaction-specific rules.

G06N 20/00 — Machine learning, where relevant to the claimed technical subject matter.

These codes are suggested for examiner searches and indexing. They are not official classifications assigned to the applications.

Original Patent References

PCT/IB2026/053385

International filing date: 7 April 2026.

WIPO publication: WO 2026/115520, published 4 June 2026.

https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2026115520

PCT/IB2026/055615 — Foundational Execution-Finality Specification

International filing date: 4 June 2026.

WIPO publication: WO 2026/150382, published 16 July 2026.

https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2026150382

Relevant technical disclosure includes separation of AI reasoning from execution authority, protected action validation, sandbox egress enforcement, authorization capabilities, runtime provenance, and Finality Sink verification.

Author: Sangam Kumar Das Independent Inventor and Researcher Balasore, Odisha, India Email: [email protected]

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS