When AI agents change, should their permissions change too?

Permission needs a current justification

In Assurance-Conditioned Continuous Authorization for Autonomous AI Agents, independent researcher Mehdi Shajari proposes ACCA: a framework for adjusting an agent’s operational authority as its supporting evidence and circumstances change. Version 1 was posted to arXiv on November 3, 2026. It is a preprint; the supplied source does not establish peer-reviewed validation.

The problem is the gap between permission and execution. An agent might obtain approval for an order, then switch models or encounter a market regime outside its evaluation conditions. Its identity and credentials could remain unchanged even though the justification for autonomous execution has weakened.

Shajari does not claim to have invented continuous authorization, permission envelopes or version-based revocation. The proposed contribution is their integration around an explicit chain: currently eligible evidence supports assurance claims, and policy translates those claims into bounded operational authority.

Evidence can remain valid but stop applying

ACCA distinguishes evidence validity from contextual applicability. An evaluation can remain authentic and unexpired while no longer describing the system or environment now in use. A test tied to one model, for example, need not justify authority after that model is replaced.

Eligible evidence must meet both conditions. Separate rules determine whether that evidence sufficiently supports an assurance claim. Policy then determines what authority follows; evidence does not grant permission by itself.

The resulting “effective-authority envelope” can constrain actions, resources, monetary limits, autonomy, approvals, delegation and execution environments. It must stay within a separately authorized ceiling. Better performance or a newly learned capability cannot independently raise that ceiling.

A Domain Governance Profile supplies domain vocabulary and rules for interpreting evidence and dependencies. It does not itself grant authority. Declared dependencies identify potentially affected decisions, but reevaluation—not simply noticing a change—determines whether authority changes.

What the trading prototype showed

The reported evaluation uses controlled regression scenarios in a research implementation built on the open-source AI Hedge Fund project. The paper identifies 48 composed trading-profile tests and 25 isolated core-governance tests supporting the implementation claims. Another 20 synthetic security-operations tests are exploratory, not cross-domain validation. Not every scenario exercises the complete platform execution path.

In one trading scenario, the model, credentials, declared ceiling and evidence validity stayed fixed while the market moved into an unevaluated regime. Supporting evidence became inapplicable. Under the configured conservative policy, the maximum order value fell from $10,000 to $1,000, live authority was removed, and autonomy dropped to proposal-only operation. The agent could not itself execute the resulting orders. Returning to the evaluated regime restored policy-authorized authority.

Other scenarios tested model substitution, denial of undeclared or out-of-scope actions, and policy-dependent outcomes. Identical assurance conditions produced different restrictions under different policies. A dashboard-theme change left authority unchanged, illustrating selectivity over the declared dependencies rather than automatic disruption after every update.

These are reported implementation results under designed conditions, not measured success rates against a representative population of real agent failures.

Stopping yesterday’s approval

ACCA versions the complete effective-authority envelope with an “authority epoch.” The epoch advances whenever that envelope changes, whether authority contracts, expands or is reconfigured. An unchanged envelope retains its epoch.

In the stale-authorization test, an action authorized under epoch 1 was presented after an authority contraction advanced the current epoch to 2. The local gateway rejected it before calling the simulated broker; broker calls remained zero. A delayed queue shown in the paper is illustrative, not part of that experiment.

This boundary matters. Checking immediately before an external call does not prevent a later race at a non-cooperating provider. Stronger protection requires suitable transactions, conditional writes or provider-side fencing. Those external commitment guarantees were not demonstrated.

The design also describes an optional authorization-basis version for changes such as withdrawal of an order-specific approval without changing standing authority. The prototype does not implement that mechanism.

What remains unproven

The study assumes protected governance state, trustworthy inputs and enforcement paths the agent cannot bypass. An epoch check cannot detect a relevant change that monitoring has not yet observed and processed. Missing dependencies or misleading evidence can therefore undermine the justification being maintained.

There is no independent validation or controlled comparison with competent continuous-authorization baselines. Behavioral-failure detection, online-learning governance, progressive authority expansion and production distributed enforcement remain unevaluated capabilities.

Reported microsecond timings measure isolated, in-process operations through an exploratory security-operations adapter—not trading-path or production latency. The author also discloses pending Canadian patent applications concerning agent governance and authorization.

The supported conclusion is narrower than general AI safety: this prototype demonstrates selected assurance-driven permission transitions and local rejection of stale actions. Whether its evidence and governance rules reliably capture real deployment risks remains a separate question.