Agentic Effectuation Boundary and Execution-Finality Architecture

Abstract

As autonomous AI agents increasingly receive delegated authority to execute API mutations, settle financial payments, manage critical power grids, control robotic systems, and modify enterprise infrastructure, existing security architectures reveal a critical effectuation-boundary gap. Prevailing mechanisms—such as OAuth 2.0 delegation, Rich Authorization Requests (RAR), sender-constrained DPoP keys, transaction tokens, and RATS remote attestation—focus primarily on access permissions, key possession, token propagation, and execution-environment trustworthiness. However, these building blocks do not verify whether the exact consequential operation remains authorized at the specific commit instant.

An approved operation can become unsafe between planning and execution due to parameter substitution, stale external prerequisites, delegation expansion, policy epoch advances, replay races, or unmediated alternate-path bypasses. This specification defines an execution-finality architecture that addresses this vulnerability.

Under this framework, a proposed Candidate Act remains held in a strictly Non-Effective State. A protected enforcement point generates an act-bound Execution Handle cryptographically tied to the canonical parameters, policy epochs, anti-replay nonces, and the intended consequence boundary. Mediation terminates at a mandatory Finality Sink—such as a payment adapter, industrial interlock, motion-command gate, or database commit boundary—which independently reconstructs the live act, revalidates mutable dependencies, ensures path completeness, and executes an atomic check-and-consume commit. Missing or unverifiable lineage is treated as UNKNOWN and fails closed. Across diverse domains, the architecture guarantees that autonomous computation, valid credentials, and platform attestation alone do not constitute authority for irreversible physical or systemic consequence.

  [ Autonomous Model / Agent Workspace ]
                     │
                     │ Proposes exact Candidate Act
                     ▼
        ┌─────────────────────────┐
        │   Non-Effective State   │ ◄── Strictly held from effect
        └────────────┬────────────┘
                     │
                     │ Protected validation (Identity, RAR, RATS, Policy)
                     ▼
        ┌─────────────────────────┐
        │    Execution Handle     │ ──► [ Act Digest + Nonce + Epoch + Sink ID ]
        └────────────┬────────────┘
                     │
                     │ Evaluated at boundary
                     ▼
        ┌─────────────────────────┐
        │      FINALITY SINK      │ ◄── Reconstructs live act parameters
        │ (Command / Commit Gate) │
        └────────────┬────────────┘
                     │
           [ Atomic Check-and-Commit ]
                     │
         ┌───────────┴───────────┐
   Pass  │                       │ Fail / Stale / Unknown
         ▼                       ▼
  ┌──────────────┐        ┌──────────────┐
  │ IRREVERSIBLE │        │ FAIL-CLOSED  │
  │ EFFECTUATION │        │   (BLOCK)    │
  └──────────────┘        └──────────────┘