ArXiv paper finds agents act on plan steps you did not see

An AI agent running a long task often rewrites its own plan partway through. The new steps it generates were steps you did not see and did not approve. This paper calls that the authorization gap, and that gap is the central design problem the research addresses. The authors show that your original approval covers the stated plan, not the steps the agent invents later. They build a formal model to check whether a replanned action still falls inside what you agreed to. The model runs checks during execution. That is the key finding: authorization can be tested at the moment the agent proposes a new step, before it acts. For a product team, this means the approval interaction needs to extend past the start of a task. You approve a plan at the beginning, but the agent may diverge from that plan many times before it finishes. The design question is what the agent shows you when it replans, and whether you confirm, adjust, or stop it. This paper gives that question a rigorous foundation and offers a working verification approach.