← Field Notes
SEP 16 · Paper · via arXiv ApprovalBudget ScopingPermissions

AcquireBound makes agents ask before grabbing new access

The gap this paper names is real: an agent starts with approved access, then grabs more, and no one saw that happen. Any product with long-running agents needs a decision surface at acquisition time, not only at setup.

Machine summary of the source

A research team built AcquireBound, an authorization system for AI agents that pick up new resources while running. The core problem: an agent starts with approved access to one thing. Along the way, it picks up a database connection or an external service. That new access was reviewed by no one. The team calls this 'acquire-bound' authority and shows that existing designs do not address it. AcquireBound requires an agent to pause and get approval before it can use any resource it picks up mid-task. The team tested this with the Model Context Protocol, a standard for connecting agents to tools and data sources, and with Docker-based multi-container setups. Both tests confirmed the design works in practice, not only in theory. The formal proofs cover three properties: agents cannot use unapproved resources, approvals are specific to the task at hand, and authority does not leak between tasks. For a product team, the design tension is clear: agents that pick up resources mid-task are more capable but harder to oversee. AcquireBound resolves that by inserting a reviewable decision point at the moment of acquisition. A human approves what the agent picks up along the way, not only what the agent starts with. That is a more honest model of oversight than most agent products offer today.

The summary above is generated; the note at the top is the editorial judgment. Primary source ↗