Artificial Adaptive Control Language (AACL): State-Bound Ephemeral Grammars for Secure Web Actions

Web applications commonly rely on widely deployed defenses such as tokens, headers, and
server-side validation logic to mitigate request forgery, tampering, and replay. While effective
against many threats, these mechanisms primarily establish authenticity and coarse integrity,
and do not formally enforce the precise structure and single-use semantic intent of individual
stateful actions.
This paper introduces AACL, a language-theoretic control framework in which the server
dynamically issues an ephemeral, intent-bound grammar for each sensitive action instance. Each
request is treated as a short-lived language instance and validated through formal recognition
(e.g., DFA-driven parsing) before execution. Grammars are state-bound and invalidated after use
or expiry, enforcing structural conformance and single-use semantics under explicit threat-model
assumptions.
We formalize the AACL model, describe its integration into a web application architecture,
and present a prototype demonstrating how ephemeral grammars reduce replay and structural
mutation attacks. AACL complements existing authentication and authorization mechanisms by
introducing a state-aware, language-level enforcement layer for web interactions.