# Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways

arXiv: https://arxiv.org/abs/2610.15991 · HTML: https://mlsanity.com/paper/2610.15991/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 6 of its 27 references that are in the map.
- First posted on arXiv 11 Oct 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 6 of 6)

- [SafetyRepro: Configuration-Conditional Rank Instability on Alignment Benchmarks](https://mlsanity.com/paper/2605.25492/) (2026)
- [When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents](https://mlsanity.com/paper/2606.22864/) (2026)
- [Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms](https://mlsanity.com/paper/2605.20704/) (2026)
- [Proof of Execution: Runtime Verification for Governed AI Agent Actions](https://mlsanity.com/paper/2607.05397/) (2026)
- [Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions](https://mlsanity.com/paper/2606.04193/) (2026)
- [aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents](https://mlsanity.com/paper/2607.05518/) (2026)

## Abstract (arXiv)

Distributed agent workflows cache delegated authority at tool gateways. Revocation may be reported at issuer commit, transport acknowledgment, or receiver persistence, although none of these observations establishes that all gateways enforced the change or that guarded effects stopped. We define C0-C5, a bounded outcome contract spanning issuer commit through effect prevention, and implement it as a persistent monitor over a frozen gateway set, call set, and observation window. A 14-case fault matrix checks conservative classification, sticky violations, restart persistence, and evidence immutability. In a derived audit of its eight semantic cases, treating C3 or C4 as completion produces seven or five false positives, respectively; the bounded C0-C5 verdict produces none. Descriptive scaling covers 1,024 gateways and 10,000 effect vectors. The primary experiment uses the maintained Keycloak 26.7 identity server and measures the contract across two durable receivers, eight physical agent-tool gateways, Filesystem and PostgreSQL effects, and 16 AWS hosts in three availability zones. Normal delivery and recovery commit no effects. Under receiver-selective non-delivery, transport acknowledgment and receiver persistence still succeed, but 112 of 225 calls (49.78%) are admitted, and all 112 effects commit in every treatment block. A separately provisioned execution repeats the result. OPA/Toxiproxy and a live three-role LLM workflow with networked MCP tools reproduce the persisted-but-not-enforced boundary on narrower surfaces. Finally, an unmodified external MCPMark agent executes 60 closed-loop task arms. Normal C4 denies all 31 exposed post-barrier calls and commits no effect; selective C3 allows 344 calls and commits 145 effects across Filesystem and PostgreSQL. Transport success is therefore evidence of progress, not a revocation-completion verdict.