# Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept

arXiv: https://arxiv.org/abs/2607.21325 · HTML: https://mlsanity.com/paper/2607.21325/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 38 references that are in the map.
- First posted on arXiv 23 Jul 2026.

## Builds on (most cited first, 9 of 9)

- [A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control](https://mlsanity.com/paper/2505.19301/) (2025)
- [Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world](https://mlsanity.com/paper/2510.25819/) (2025)
- [AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A](https://mlsanity.com/paper/2603.24775/) (2026)
- [Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility](https://mlsanity.com/paper/2512.17538/) (2025)
- [Zero-Knowledge Proof Frameworks: A Systematic Survey](https://mlsanity.com/paper/2502.07063/) (2025)
- [The Aegis Protocol: A Foundational Security Framework for Autonomous AI Agents](https://mlsanity.com/paper/2508.19267/) (2025)
- [DIAP: A Decentralized Agent Identity Protocol with Zero-Knowledge Proofs and a Hybrid P2P Stack](https://mlsanity.com/paper/2511.11619/) (2025)
- [Building a robust OAuth token based API Security: A High level Overview](https://mlsanity.com/paper/2507.16870/) (2025)
- [Zero-Knowledge Audit for Internet of Agents: Privacy-Preserving Communication Verification with Model Context Protocol](https://mlsanity.com/paper/2512.14737/) (2025)

## Abstract (arXiv)

Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This study hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted RCVA, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems, a distinction to our knowledge, has not been formalized within a cryptographically verifiable authorization relation by current agentic security frameworks, and present a falsifiable research agenda for its resolution.