Abstract
Remote attestation can prove that a CPU, confidential virtual machine, GPU, AI accelerator, DPU or SmartNIC is running expected firmware and software. But an attestation result describes the environment, not the operations that environment later emits: it is identical whether the next request came from correct logic, prompt injection or model error. As agentic AI moves onto confidential accelerator infrastructure, it emits high-consequence operations — payments, cloud-control changes, database deletions, deployments, external API calls — where a trustworthy platform cannot by itself decide whether one concrete operation should take effect. OAuth access tokens, transaction tokens and workload credentials do not close the gap: they authorise by scope and possession rather than by the exact content of one operation, and they do not make the protected effect unreachable except through a verifying boundary. This paper describes an attestation-bound execution-finality architecture. A consequential operation starts as a non-effective candidate act. A validator combines the act's security-relevant arguments with the platform's attestation result, workload identity and policy, and issues an act-bound, single-use, non-bearer execution handle signed with a key separate from any attestation key. A finality sink at the non-bypassable point where the effect would first occur — API gateway, service mesh, DPU, SmartNIC, database commit or cloud control plane — reconstructs the act, verifies the handle and consumes it, so an approved act cannot be swapped, mutated or replayed. No changes to silicon, firmware, drivers or accelerator programming models are needed; expensive attestation stays on a cold path, while per-act checks are local. A runnable vendor-neutral reference implementation passes 11 tests including byte-level vectors. Statements about NVIDIA, Arm, AMD and Intel platforms rely on public documentation only and were not tested on their hardware. The author is open to acquihire or strategic collaboration. IETF draft: https://datatracker.ietf.org/doc/draft-das-rats-attestation-bnd-execution-finality/
KEYWORDS remote attestation, RATS, Entity Attestation Token, confidential computing, confidential GPU, GPU attestation, AI accelerator, DPU, SmartNIC, workload identity, WIMSE, OAuth transaction tokens, agentic AI security, prompt injection, act-bound authorization, single-use token, replay protection, COSE, deterministic CBOR, policy enforcement point, zero trust, fail-closed
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "A Trusted GPU Can Still Wire the Money: Why Attestation Proves the Machine but Not the Operation — and How to Bind Authority to the Exact Act Before It Takes Effect", Technical Disclosure Commons, (November 05, 2026)
https://www.tdcommons.org/dpubs_series/12750