# Autonomous AI agents

For autonomous AI agents in ambient wearable settings, DualTrust replaces a secondary LLM classifier on the tool-call path with a deterministic state-and-quota gate. It keeps the human principal's credit separate from the agent's Bayesian behavioral standing, escalates penalties superlinearly with cumulative strikes, and commits every verdict to a verifiable Merkle audit ledger. In the in-memory tier, median latency over 10,000 evaluations was 47.10 microseconds, against published neural-guardrail medians of 390 and 810 milliseconds.

For autonomous AI agents in ambient wearable settings, DualTrust replaces a secondary LLM classifier on the tool-call path with a deterministic state-and-quota gate. It keeps the human principal's credit separate from the agent's Bayesian behavioral standing, escalates penalties superlinearly with cumulative strikes, and commits every verdict to a verifiable Merkle audit ledger. In the in-memory tier, median latency over 10,000 evaluations was 47.10 microseconds, against published neural-guardrail medians of 390 and 810 milliseconds.

The authors propose the Cryptographically Verifiable Agent Authorization (CVA) hypothesis, formalizing authorization as a relation RCVA that jointly binds an agent principal, a concrete authorization request, an execution context, and policy satisfaction, and provide candidate security properties plus an executable zero-knowledge proof of concept over Groth16 zk-SNARK; the prototype implements principal binding and plan-level request binding while context binding and runtime execution binding remain unimplemented.

The authors propose the Cryptographically Verifiable Agent Authorization (CVA) hypothesis, formalizing authorization as a relation RCVA that jointly binds an agent principal, a concrete authorization request, an execution context, and policy satisfaction, and provide candidate security properties plus an executable zero-knowledge proof of concept over Groth16 zk-SNARK; the prototype implements principal binding and plan-level request binding while context binding and runtime execution binding remain unimplemented.