AcquireBound introduces a provenance‑bounded runtime authorization architecture. After an autonomous AI agent acquires compute, credentials, accounts, services and similar resources, the outputs are placed in a quarantine zone. A versioned resolver extracts the actual capabilities from authenticated providers. Only a current activation transaction that validates the manifest, provenance, epochs and a downward‑closed relational envelope over a typed resource‑capability hypergraph can release the resource. The envelope preserves correlated identity, effect, data, delegation and graph‑wide limits. Single‑use effect permits are revalidated and consumed during effect linearization.
Under explicit assumptions the paper proves eight safety properties covering quarantine, backing, non‑amplification, split non‑evasion, crash/retry, refunds, epochs and effect confinement. Experiments span five resource classes: reference semantics accepted all 20 benign traces and rejected all 40 registered unsafe traces across 810 events. An independent checker agreed on 60 base and 40 refinement traces and rejected all 89 tamper tests. Frozen Codex and Gemini MCP client components completed 54 deterministic local stdio calls. In a staged 18‑case MCP‑to‑Docker composition, every benign path succeeded while none of the 16 unsafe paths generated an unauthorized Docker start request. A five‑source audit classified 1,248 field pairs across 32 units, with no single unit supplying a complete activation profile.
Review