这篇论文给AI Agent授权画了一条红线，解释了为什么进化后的Agent可能不是你原来授权的那个，以及如何用固定上限保证安全。做Agent框架的值得一看。
该论文提出授权连续性概念，解决长期运行AI Agent在部署后进化导致的授权失效问题。作者设计了状态边界模型，在授权时固定一个转换包络和不可变效应上限，确保Agent演化不会突破用户设定的效应边界。模型区分请求效应和实现效应，证明在完全中介、合理抽象、衰减委托和监控完整性条件下，演化无法放大保护效应。论文还映射了六类Agent突变的授权后果。
Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents
Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. This improves adaptation but creates a distinct authorization problem. Tool-enabled agents can turn model errors and prompt injections into consequential external actions; when evolution occurs under a live grant, the subject exercising that authority or the context in which it acts may no longer match what the user evaluated. Evolution can change both the effects reachable under an old grant and the authority required by the task, which may rise, fall, or become incomparable. Existing tool policies constrain actions but do not determine when a grant survives this change. We formulate authorization continuity: when does an existing grant remain valid, how may active authority change, and what boundary must never move? Our state-bound model fixes a transition envelope and an immutable effect ceiling at grant time. The envelope determines whether the grant survives a mutation; below the ceiling, authority may contract freely and expand only under specified evidence conditions. We distinguish requested from realized effects and prove that, under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling. Agent-produced evidence may allocate authority below the ceiling but cannot raise it. Finally, we map six mutation classes to their authorization consequences.