Lifei Liu, Haoran Yu and Danping Zhang test what happens when a permission-revocation message reaches its receiver but fails to reach the gateways controlling an agent’s tools. Both receivers acknowledge and store the message. Four of eight gateways keep accepting the old permission.
Their completion check follows the revocation from the issuer through delivery, gateway enforcement and independently observed file or database changes:
- In each 225-call treatment block, 112 calls still committed effects. Normal delivery and recovery committed none. Two separately provisioned 16-host executions each repeated 30 blocks.
- That 49.78% follows from the experiment’s preassigned gateway split. It measures the consequence of the injected fault, rather than its frequency in deployed systems.
- An adaptive agent test made 344 allowed calls and committed 145 effects after revocation under the fault. With normal enforcement, all 31 later calls were denied. The arms produced different call sequences, and only 4 of 60 task runs passed the task verifier.
- The monitor preserves violations after late enforcement receipts arrive. Completion applies only to the named gateways, calls and observation window.
The operational question is whether every place that can execute the agent’s work has stopped honoring its authority. A successful acknowledgment from the identity provider answers an earlier question. The authors also retain failed cost and workload hypotheses, rather than claiming one repair strategy wins everywhere.
Caveat: these are author-run controlled experiments, and the linked raw-evidence bundle returned HTTP 403 when checked.