Abstract
Authentication, attestation and access control establish who or what is requesting an action; they do not establish that a specific action, with specific parameters, at a specific enforcement boundary and at a specific moment, is authorized to take effect. This disclosure describes a vendor-neutral method and system that closes that gap by separating the ability to compute an action from the authority to carry it out.
In the disclosed method, a consequential action generated by an AI model, agent, controller or scheduler is held as a pending candidate action and does not take effect on generation. A protected policy decision component, running in an isolated or hardware-protected execution environment, validates the exact action, including its parameters, target resource, enforcement boundary and validity window. Before any authorization is issued, the component writes a tamper-evident evidence record, for example a hash-chained, signed log entry. It then issues a single-use authorization token cryptographically bound to a digest of the exact action, to one specific enforcement point and to a short expiry window. A final enforcement point located at the last point before the physical or logical effect re-reads the action actually about to be executed, recomputes its digest, and in a single atomic operation verifies the token signature or MAC, the action binding, the boundary binding, the time window, revocation status and single-use state, then consumes the token. The effect is released exactly once on success; on any mismatch, missing input, expiry, revocation or internal error, nothing is released (fail-closed). Replay, parameter substitution after approval, time-of-check-to-time-of-use races, state rollback, crash during commit and concurrent double use are thereby prevented.
The disclosure provides 162 implementation profiles applying this method to distinct enforcement boundaries, plus 12 variations of the core enforcement points. Fields covered include AI agent tool calls and Model Context Protocol (MCP) servers; AI-native RAN, O-RAN xApps and rApps, and 6G control planes; spectrum access, beam steering and sub-THz emission; integrated sensing and communication (ISAC) and location-data release; ambient IoT; post-quantum key activation; robotic and autonomous-vehicle actuation; XR and wearable sensor release; and AI-accelerator and data-center hardware, including CXL memory transactions, HBM, UCIe chiplet links, IOMMU and DMA transfers, DPU and SmartNIC data paths, and co-packaged optical link enablement.
A runnable Python reference implementation is provided in two variants (HMAC-SHA256 and Ed25519). It passes 42 of 42 automated tests covering replay, parameter substitution, revocation races, state rollback, crash during commit, a 32-thread double-spend attempt and 2,000-case fuzzing. Measured median cost per action in software on one cloud vCPU is about 61–63 µs (HMAC) and 220–232 µs (Ed25519). Code, tests and results are the author’s own and have not been peer reviewed.
This disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026, which claims priority from PCT/IB2026/053385, filed April 2026 and publicly disclosed 4 June 2026. The author is open to strategic collaboration, licensing or acquihire discussions.
Keywords: execution authorization; single-use capability token; action-bound authorization; reference monitor; policy enforcement point; policy decision point; fail-closed; exactly-once execution; atomic check-and-consume; anti-replay; TOCTOU prevention; tamper-evident audit log; hash chain; trusted execution environment; AI agent tool calls; Model Context Protocol (MCP); AI-RAN; O-RAN; 6G; ISAC; spectrum access control; post-quantum key activation; robot actuation safety; XR privacy; CXL; UCIe; IOMMU; DMA; DPU; co-packaged optics; confidential computing; EU AI Act.
Suggested CPC classes (for search): G06F 21/52; G06F 21/62; H04L 9/32; H04L 9/40; H04L 63/10; H04W 12/08; G06F 13/28; B25J 9/16; G06N 20/00.
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "Last-Point, Single-Use Execution Authorization for AI-Initiated Actions: A Fail-Closed Enforcement Gate Across Agentic AI Tool Calls, AI-Native RAN and 6G, Robotics, XR and AI-Accelerator Interconnects", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/12819