[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-327120-105":59,"doc-detail-327120-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","lingering-authority-revocable-resource-and-effect-capabilities-for-coding-agents","Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","","Coding agents often receive broad tool access for entire tasks, even when a needed capability applies only to a single subgoal. This work formalizes lingering authority, where a temporary resource/effect capability remains exposed after its justification episode ends. PORTICO is a reference monitor that compiles explicit task contracts into initial capabilities, grant rules, closure predicates, and deny rules, using epoch-bound handles. Evaluations compare PORTICO with non-revoking and all-visible comparators, and audit stale replays across controlled and real repository layouts.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/lingering-authority-revocable-resource-and-effect-capabilities-for-coding-agents/327120/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/lingering-authority-revocable-resource-and-effect-capabilities-for-coding-agents/327120.png","ImageObject",300,407,{"name":92,"@type":93},"Jiven","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-17","2026-09-21",true,{"@type":102,"interactionType":103,"userInteractionCount":24},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What is “lingering authority” in coding-agent systems?","Question",{"text":112,"@type":113},"Lingering authority refers to a temporary resource/effect capability that remains exposed to the planner after the episode that justified granting it has ended. If the agent later uses this stale authority, the planner interface has exposed capabilities that should have been revoked.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does PORTICO enforce revocation for exposed capabilities?",{"text":117,"@type":113},"PORTICO compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules. Grants mint epoch-bound handles for covered resources/effects, and closure removes those handles from the next planner interface while rejecting stale replay at execution time.",{"name":119,"@type":110,"acceptedAnswer":120},"What do the evaluations compare PORTICO against?",{"text":121,"@type":113},"The evaluation uses controlled fixture suites and a real pinned repository suite, comparing PORTICO with a non-revoking comparator under the same initial grants. It also uses an all-visible same-policy comparator to isolate interface breadth effects, plus a coarse action-filter diagnostic to assess broader adjacent authority.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},327120,1791360924,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":24,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":46,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":143,"read_time":31,"preview_page_count":4},1099513958607,"https://ap-avatar.wpscdn.com/avatar/100002390cf8733938c?x-image-process=image/resize,m_fixed,w_180,h_180&k=1778829742770036399","Lingering Authority: Revocable Resource-and-Effect Capabilities  \nfor Coding Agents  \nIgor Santos-Grueiro  \nInternational University of La Rioja  \narXiv :2606 .22504v1 [ cs .CR] 21 Jun 2026  \nAbstract  \nCoding agents often receive broad tool access for an entire task, even when a resource is needed only for one subgoal. We call this gap lingering authority: a temporary resource/effect capability remains exposed after the episode that justified it has closed.  \nPORTICO is a reference monitor for revocable capabilities exposed to the planner. It compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules. A request–grant–invoke lifecycle materializes expansions as opaque, epoch-bound handles. Closure removes those handles from the next planner interface and rejects stale replay before side effects. The monitor assumes mediated tools and a sound typed catalog.  \nIn controlled coding-agent tasks, PORTICO records no executed contract-forbidden effects in the evaluated runs, while controlled grants recover boundary work blocked by a fixed narrow envelope. A non-revoking comparator receives the same initial envelope and the same grants at the same turns. On the closure slice, both systems match task success, scope compliance, and all pre-closure decisions; PORTICO then rejects 10/10 post-closure reuses, while the comparator permits 10/10 . A deterministic stale-write audit records 0/6 versus 6/6 executed forbidden effects. Scripted traces and six live model traces over file writes, git mutation, and network egress show the same split. In a four-episode same-policy diagnostic, broad request exposure preserves zero executed forbidden effects but raises blocked proposals from 67 to 84 . Frozen real-repository runs, with commits and traces recorded, exercise the same lifecycle on real project layouts.  \n1 Introduction  \nCoding agents turn natural-language tasks into tool calls over repositories, tests, shells, package managers, network clients, and version control. They often start with more authority than the task needs. The key problem is temporal: authority justified for one subgoal can become stale once that subgoal  \ncloses. If the agent later uses this stale authority, the plannertool interface has exposed lingering authority: a temporary resource/effect capability that remains exposed after the grant episode that justified it closed.  \nConsider a task that propagates a timeout from src/api. py to src/serialization.py. The initial phase needs the API file, the focused API test, and the test command. The contract declares serialization access as an on-demand boundary capability. A planner request may select that declared rule, but it cannot create new authority. A plausible note such as notes/packaging.md is outside the task. The desired behavior is to deny the note, grant serialization authority for the boundary episode, and revoke that authority when the episode closes. A static allowlist or sandbox may make the serialization file reachable for the whole run. The security question is whether it should remain available to the planner for the whole run.  \nExisting defenses address adjacent layers: hostile content or proposed actions [1, 2, 8, 11, 42, 44, 46, 56–58], tool and protocol trust [15–18, 21, 29, 33, 37, 49, 54], and reachability or execution checks after tool selection [4, 7, 9, 19, 28, 34, 38, 45, 47, 48, 52, 59, 61] . They leave an earlier choice open: which otherwise admissible authority should be visible to the planner now, and when should temporary authority disappear? If a broad read option remains in the planner interface, the model can keep planning around it even when a later monitor would reject some calls. The exposed interface is therefore part of the security state.  \nWe use capabilities exposed to the planner for resourceand effect-specific authority exposed through the mediated interface as current handle state. They are distinct from runtime a","cbCaia0mn8KbPygr","https://ap.wps.com/l/cbCaia0mn8KbPygr","pdf",354224,"English","# Introduction\n## Problem: Temporal staleness of authority\n## Key idea: Lingering authority as exposed planner handle state\n## Definitions: exposed handles vs runtime availability and checks\n## Approach: PORTICO reference monitor with task contracts\n## Evaluation setup and comparators\n# Contributions","[{\"question\":\"What is “lingering authority” in coding-agent systems?\",\"answer\":\"Lingering authority refers to a temporary resource/effect capability that remains exposed to the planner after the episode that justified granting it has ended. If the agent later uses this stale authority, the planner interface has exposed capabilities that should have been revoked.\"},{\"question\":\"How does PORTICO enforce revocation for exposed capabilities?\",\"answer\":\"PORTICO compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules. Grants mint epoch-bound handles for covered resources/effects, and closure removes those handles from the next planner interface while rejecting stale replay at execution time.\"},{\"question\":\"What do the evaluations compare PORTICO against?\",\"answer\":\"The evaluation uses controlled fixture suites and a real pinned repository suite, comparing PORTICO with a non-revoking comparator under the same initial grants. It also uses an all-visible same-policy comparator to isolate interface breadth effects, plus a coarse action-filter diagnostic to assess broader adjacent authority.\"}]","Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents | PDF",1789976476]