Research & Architecture

Papers, protocols and system designs aimed at constraining agent behaviour. We read them for what they would change in a production system, not for their benchmark numbers.

Foundational reading

15 pieces

18 August 2026

The Agent Never Gave Itself the Instruction. Another Agent Did.

Researchers from the Anthropic Fellows Program, EPFL and Anthropic built two experimental settings in which an instruction copies itself from agent to agent through a persistent file that gets injected into the next agent's system prompt. Four action payloads survived twenty hops. A one paragraph warning in the system prompt shut propagation down almost completely. Moona Intelligence reads the whole result as an authority question: persistent state is a channel through which objectives cross agent boundaries without anyone making a new authorization decision.

Agent Authority10 min read·Moona Intelligence

More in this topic

28 August 2026

SARC Shows Why Remediated Agent Actions Need to Be Re-Evaluated

SARC Suite One-Pass, Gaston Besanson's artifact for the paper One Gate Is Not Enough, composes three governance engines at a single pre-action control point and adds a Remediate-Regate protocol: evaluate the evidence gate first, recompute context after substitution, then re-evaluate every gate on the remediated action. I reproduced its 207 reported tests from a clean clone, then added 8 adversarial tests of my own without changing any existing code or scenario. All 215 passed. The reauthorization holds for the two properties its authority policy actually reads, role and order value. Six other properties the action context carries, including which resource is targeted, which agent is acting, and when the action happens, are present in the data but never reach the authority decision.

Agent Authority14 min read

23 August 2026

Your Agent Has a Certificate. Now the Certificate Wants to Prove Where Its Authority Came From.

Draft wei aic identity cert 00, AI Agent Identity Certificate (AIC) Extension for X.509 v3, was posted to the IETF Datatracker on 19 August 2026 by Jijie Wei as an individual Experimental Internet Draft. It proposes a certificate extension binding an agent's identity to a principal, carrying capability and constraint fields and a signed delegation record, alongside a companion PrincipalAuthorization extension in the principal's own certificate. Moona Intelligence reads it against the harder question underneath: can a relying party establish not only that a principal delegated a capability, but that the principal was itself certified as holding authority that included it.

Agent Authority16 min read

22 August 2026

The Agent Has a Credential. x401 Asks Who Actually Gave It the Authority.

Proof launched x401, the HTTP Proof Requirement Protocol, on 25 June 2026. The specification now published as version 0.2.0 has changed materially since that launch: Agent binding, required in version 0.1.0, is now explicitly optional, and a delegation evidence mechanism that version 0.1.0 left as an open question is now named and specified. Moona Intelligence reads the current draft directly against a strict Agent Authority and Authority Provenance standard, distinguishing what the generic protocol establishes from what only Proof's own implementation, a human verified to IAL2 signing a scoped mandate, actually does.

Agent Authority15 min read

22 August 2026

Visa and Mastercard Joined the Same Room. They Still Have to Decide Who Authorized the Agent.

Rain convened 26 companies, among them Visa, Mastercard, Fiserv, Circle, Fireblocks and Coinflow, into the Agentic Payments Alliance on 18 August 2026. Rain describes it as a coalition run collectively by its founding members, with early work expected to include shared research, testing emerging standards for agent identity and authorization, and advocacy on regulatory questions. Moona Intelligence reads the announcement against what it actually establishes: a formal industry recognition that agent payment authority has to travel across organizations that never participated in the original delegation, and no published answer yet for how a downstream participant verifies that authority.

Agent Authority21 min read

22 August 2026

The Agent Has Authority. Nuggets Wants Proof of Who Gave It.

Nuggets announced its Authority Control Plane on 22 July 2026, describing an enforcement point that evaluates an agent's identity, authority, organizational policy, intent and runtime context before an action proceeds, then issues a cryptographically signed Action Receipt for the decision. Moona Intelligence reads that claim against Nuggets' own documentation and against langchain nuggets, its public open source integration, to separate what is independently verified from what is Nuggets describing its own system. The distinct question this record tracks is not whether the action was allowed. It is whether anyone can show who gave the agent its authority in the first place, and whether that person was actually entitled to give it. Updated 23 August 2026 with the Fintech Times' corroborating coverage of the same launch and with Forrester's own, earlier research on the broader agent control plane category this launch sits inside.

Agent Authority14 min read

22 August 2026

The Agent Has Permission. Can It Prove Who Gave It That Authority?

Joseph Geo Benjamin, Anil K. Jain and Karthik Nandakumar propose BIND, a framework that binds a human's biometric to an AI agent's identity and a task specific authority scope at the moment authority is delegated, producing a delegation token an Identity Auditor can later use to recover who authorized what. arXiv lists the paper, submitted 4 August 2026, as accepted for an IJCB 2026 session. Their face biometric prototype reports 96 percent True Match Rate at zero False Match Rate in the paper's own experimental setting, with 1024 bit agent tokens. This is a research proposal and a prototype evaluation, not a deployed system, and no independently reproduced or publicly available implementation was found.

Research & Architecture18 min read

21 August 2026

The Agent Can Move the Money. It Still Does Not Hold the Keys.

BNB Agent Studio v2 launched on 13 August 2026 and gained a second wallet option, Altana, on 18 August 2026. Altana lets a builder keep custody of a wallet's underlying keys while an agent acts through a session key bounded by a spending limit, a contract allowlist and an expiry, recorded on chain so the bound can be checked from outside the agent and revoked in one transaction. Moona Intelligence reads what is actually being separated: the ability to transact from the authority to redefine what transacting is allowed to mean.

Agent Authority10 min read

21 August 2026

People Are Already Giving AI Authority. Who Decides Where It Stops?

EY's 2026 Global AI Sentiment Study finds that 16% of 18,152 people surveyed across 23 markets used AI systems that acted on their behalf without human intervention in the previous six months, including 10% who used an AI agent to buy something and 11% who let AI manage banking tasks unattended. Moona Intelligence reads that as evidence that decision making authority is already moving from people to systems, before almost anyone has defined where that authority stops.

Agent Authority10 min read

21 August 2026

Singapore Listed Ten Ways to Control an Agent. Human Approval Is Only One of Them.

The Singapore AI Safety Institute published a Companion Report on Agentic Risk Management alongside the 2026 Singapore Consensus on Global AI Safety Research Priorities in July 2026. It sets out ten foundational principles across the agentic lifecycle: least privilege, traceable identity and auditability in design and development; validated deployment, adversarial resilience and multi agent stability in testing and deployment; runtime assurance, interruptibility, legibility and human oversight in operation and monitoring. The interesting structural fact is not that human oversight appears. It is that it appears once, in the last group, next to a separate principle covering the ability to stop the agent. Approving an action and being able to halt one are being treated as different controls held by different parts of the system.

Governance & Policy9 min read

17 August 2026

The Agent Paid. Now Prove That Payment Was Authorized.

AWS and Solv Labs describe a governed agent payments workflow on Amazon Bedrock AgentCore payments in which a proposed transaction is evaluated against policy before it can settle, and each governed payment carries a signed record of that evaluation. AWS and Solv Labs are explicit about what the record does not prove. Moona Intelligence reads what is left: whether evidence for a consequential financial action can be produced at the same boundary where it is authorized, not reconstructed afterward.

Agent Authority36 min read

15 August 2026

The AI Agent Was Allowed to Submit the Decision. AWS Says That Does Not Mean It Should.

On August 14, 2026, AWS published a HIPAA focused reference architecture for AI agents in healthcare, illustrated with a lumbar MRI prior authorization workflow. AWS states that role based access control establishing an agent can call a submission tool does not establish that the agent should autonomously execute the consequential decision behind it. Its governed design adds a separate control, Consequential Action Approval, that pauses high risk writes for explicit human confirmation. AWS is careful to say the architecture does not create new compliance requirements. Moona Intelligence reads it as a clear statement of a distinction that outlasts this one AWS post: permission to reach an action and authority to take it are not the same question.

Agent Authority11 min read

14 August 2026

Your AI Agent's Permissions Did Not Change. Its Authority Still Did.

Google announced Gemini 3.7 Flash on 13 August 2026 and said Gemini Spark would start using it the same day. Google describes better multi step planning, better tool calls, better recovery from roadblocks, fewer retries and less manual oversight. Spark's permission surface, the connected apps, the local and remote browser, the confirmation prompts, is unchanged. That is the part worth thinking about. Effective authority can move without a single permission being edited.

Agent Authority22 min read

13 August 2026

The AI Agent Got the Right Answer. It Still Took the Wrong Path.

Researchers describe Convergent Detour Hijacking, an attack in which a single static third party skill steers an agent onto a longer, costlier execution path while leaving task completion intact. In their controlled testbed on DeepSeek V4 Pro, the attacker skill was selected in 80.02 percent of tasks, and among selected runs where both the clean and attacked executions succeeded, tokens rose 66.91 percent. Correct output did not mean the execution path was necessary.

Research & Architecture8 min read

13 August 2026

Three AI Agents Were Given Conflicting Goals. They Started Revoking Each Other's Access.

In controlled experiments published August 13, 2026, Anthropic's Frontier Red Team gave three agents conflicting objectives in a shared environment and watched them kill each other's processes, disable accounts, and revoke access. The research raises a question distinct from single-agent authorization: when several authorized agents can act against the same environment simultaneously, permission becomes a relationship between agents as well as between an agent and a resource.

Agent Authority8 min read

Where to go next

All topics →

Agent Security

Attack surface, credentials, and how agent systems actually get compromised.

Agent Authority

What agents are permitted to do, and who delegated it.