Universidade de Santiago de Compostela

The study hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, R_CVA, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy while selectively preserving the confidentiality of private authorization attributes; it introduces a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), defines a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, provides an executable zero-knowledge proof of concept instantiating selected elements of the model over a Groth16 zk-SNARK construction, and formalizes the structural separation among

The study hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, R_CVA, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy while selectively preserving the confidentiality of private authorization attributes; it introduces a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), defines a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, provides an executable zero-knowledge proof of concept instantiating selected elements of the model over a Groth16 zk-SNARK construction, and formalizes the structural separation among

The authors propose the Cryptographically Verifiable Agent Authorization (CVA) hypothesis, formalizing authorization as a relation RCVA that jointly binds an agent principal, a concrete authorization request, an execution context, and policy satisfaction, and provide candidate security properties plus an executable zero-knowledge proof of concept over Groth16 zk-SNARK; the prototype implements principal binding and plan-level request binding while context binding and runtime execution binding remain unimplemented.

The authors propose the Cryptographically Verifiable Agent Authorization (CVA) hypothesis, formalizing authorization as a relation RCVA that jointly binds an agent principal, a concrete authorization request, an execution context, and policy satisfaction, and provide candidate security properties plus an executable zero-knowledge proof of concept over Groth16 zk-SNARK; the prototype implements principal binding and plan-level request binding while context binding and runtime execution binding remain unimplemented.