Writing agent authorization as a verifiable relation: a Groth16 prototype binds principal and plan in a 531-constraint circuit, leaving execution binding open
The authors propose the Cryptographically Verifiable Agent Authorization (CVA) hypothesis, formalizing authorization as a relation RCVA that jointly binds an agent principal, a concrete authorization request, an execution context, and policy satisfaction, and provide candidate security properties plus an executable zero-knowledge proof of concept over Groth16 zk-SNARK; the prototype implements principal binding and plan-level request binding while context binding and runtime execution binding remain unimplemented.