Paper deep dive

The Bureaucracy of Speed: Structural Equivalence Between Memory Consistency Models and Multi-Agent Authorization Revocation

Vladyslav Parakhin

Year: 2026Venue: arXiv preprintArea: cs.MAType: PreprintEmbeddings: 49

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%

Last extracted: 3/13/2026, 12:07:46 AM

Summary

The paper introduces a 'Capability Coherence System' (CCS) that models multi-agent authorization revocation as a cache coherence problem, specifically mapping authorization states to the MESI protocol. It demonstrates that time-bounded revocation (TTL) scales poorly with agent velocity (O(v*TTL)), whereas an execution-count 'Release Consistency-directed Coherence' (RCC) strategy provides a velocity-independent safety bound (Drcc <= n), significantly reducing unauthorized operations in high-velocity agentic environments.

Entities (5)

Vladyslav Parakhin · author · 100%MESI Protocol · hardware-protocol · 99%Capability Coherence System · framework · 95%Release Consistency-directed Coherence · revocation-strategy · 95%Velocity Vulnerability · metric · 92%

Relation Signals (3)

RCC → boundsunauthorizedoperations → n

confidence 98% · A safety theorem bounds unauthorized operations for the execution-count Release Consistency-directed Coherence (RCC) strategy at Drcc≤n

Velocity Vulnerability → appliesto → TTL-based strategies

confidence 95% · Damage potential of TTL-based approaches is formalised as Vv=v⋅TTL

Capability Coherence System → usesmapping → MESI Protocol

confidence 95% · construct a state-mapping φ:ΣMESI→Σauth

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:The temporal assumptions underpinning conventional Identity and Access Management collapse under agentic execution regimes. A sixty-second revocation window permits on the order of $6 \times 10^3$ unauthorized API calls at 100 ops/tick; at AWS Lambda scale, the figure approaches $6 \times 10^5$. This is a coherence problem, not merely a latency problem. We define a Capability Coherence System (CCS) and construct a state-mapping $\varphi : \Sigma_{\rm MESI} \to \Sigma_{\rm auth}$ preserving transition structure under bounded-staleness semantics. A safety theorem bounds unauthorized operations for the execution-count Release Consistency-directed Coherence (RCC) strategy at $D_{\rm rcc} \leq n$, independent of agent velocity $v$ -- a qualitative departure from the $O(v \cdot \mathrm{TTL})$ scaling of time-bounded strategies. Tick-based discrete event simulation across three business-contextualised scenarios (four strategies, ten deterministic seeds each) confirms: RCC achieves a $120\times$ reduction versus TTL-based lease in the high-velocity scenario (50 vs. 6,000 unauthorized operations), and $184\times$ under anomaly-triggered revocation. Zero bound violations across all 120 runs confirm the per-capability safety guarantee. Simulation code: this https URL

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

49,028 characters extracted from source content.

Expand or collapse full text

The Bureaucracy of Speed: Structural Equivalence Between Memory Consistency Models and Multi-Agent Authorization Revocation Vladyslav Parakhin Senior Data Engineer Okta Abstract The temporal assumptions underpinning conventional Identity and Access Management collapse under agentic execution regimes. A sixty-second revocation window—operationally negligible for a human operator—permits on the order of 6×1036× 10^3 unauthorized API calls at 100 ops/tick; at AWS Lambda scale, the figure approaches 6×1056× 10^5. This is a coherence problem, not merely a latency problem, and the authorization revocation literature has largely failed to recognize it as such. I define a Capability Coherence System (CCS)—a tuple ⟨A,C,Σ,δ,α,ℬ⟩ A,C, ,δ,α,B —and construct a state-mapping function φ:ΣMESI→Σauth : _ MESI→ _auth that preserves transition structure under bounded-staleness semantics. A safety theorem (theorem˜3.1) bounds unauthorized operations for the execution-count Release Consistency-directed Coherence (RCC) strategy at Drcc≤nD_rcc≤ n, independent of agent velocity v—a qualitative departure from the O(v⋅TTL)O(v·TTL) scaling of time-bounded strategies. Evaluation proceeds through tick-based discrete event simulation: three business-contextualised scenarios, four strategies, ten deterministic seeds per configuration (population σ). Eager invalidation yields 500.0±0500.0± 0 unauthorised operations at v=100v=100, Δnetwork=5 _network=5; lease-based TTL yields 6,000.0±06,000.0± 0; lazy check-on-use yields 2,400.0±02,400.0± 0; RCC at n=50n=50 yields 50.0±050.0± 0 (σ=0σ=0, confirming theorem˜3.1 exactly). Under anomaly-triggered revocation, RCC achieves a 184×184× reduction against lease TTL (16.0±3.716.0± 3.7 vs. 2,950.8±3.62,950.8± 3.6). Contributions: (1) a formal state-mapping between cache coherence and authorization revocation semantics; (2) a Velocity Vulnerability metric Vv=v⋅TTLV_v=v·TTL establishing agent velocity as a first-class security dimension; (3) an operation-bounded credential model grounded in release consistency that enforces coherence at synchronisation boundaries; (4) reproducible multi-run evaluation with published source code at https://github.com/hipvlady/prizm. Subjects: Multi-Agent Systems (cs.MA); Cryptography and Security (cs.CR); Distributed, Parallel, and Cluster Computing (cs.DC) Contents 1 The Coherence Framing 2 Theoretical Foundations 2.1 Cache Coherence Essentials 2.2 Failure Containment 2.3 Information-Theoretic Framing 3 Formal Model 3.1 Capability Coherence System 3.2 State Mapping Function 3.3 Damage Bound Functions 4 Related Work 4.1 Multi-Agent Failure Modes 4.2 Organisational Reliability Models 4.3 Trust and Security Governance 4.4 Delegation and Authorisation Standards 5 Authorisation as a Coherence Problem 5.1 Consistency-Agnostic (Eager) Revocation 5.2 Consistency-Directed (Relaxed) Revocation 6 The MESI Mapping 7 Architecture 7.1 Execution-Count Bounds as Release Consistency 7.2 Authority Service 7.3 Heterogeneous Coherence 8 Evaluation 8.1 Simulation Methodology 8.2 Scenario Configurations 8.3 Scenario 1 — Banking Cascade Revocation 8.4 Scenario 2 — CRM High-Velocity Agent 8.5 Scenario 3 — Anomaly Auto-Revocation 8.6 Cost-Benefit Analysis 9 Discussion 9.1 Scope and Applicability 9.2 Limitations 10 Conclusion References 1 The Coherence Framing The agent has already executed 47 unauthorised API calls. The authority revoked its credential at tr=0t_r=0. The TTL expires at t=60t=60. Nothing in the current authorisation stack detects this. A compromised agentic system operating under TTL-based credential management accumulates Vv=v⋅TTLV_v=v·TTL unauthorised operations before self-invalidation—a quantity linear in both velocity and window length. At v=10,000v=10,000 TPS (AWS Lambda scale) and a 60-second TTL, Vv=6×105V_v=6× 10^5. The Replit incident [13]—an AI coding agent that deleted a production database—is a concrete instance of this failure class, not an edge case. The damage bound is not incidental to the authorisation architecture; it is a structural property of the coherence regime the system operates under. IAM protocols developed for biological operators inherit implicit assumptions: session timeouts measured in minutes, revocation windows tolerable at human interaction rates (∼1 1 req/s →60→ 60 unauthorised ops), and eventual consistency acceptable as a design trade-off. Autonomous agents violate every one of these assumptions simultaneously. OAuth 2.0, OIDC, and their derivatives were not designed for entities capable of recursive delegation, high-frequency decision loops, and parallel execution across thousands of concurrent sessions. The OpenID Foundation [12] identifies revocation across offline-attenuated delegation chains as “largely unsolved.” Chan et al. [6] argue that AI systems require distinct, verifiable identities rather than repurposed human credentials. Nagabhushanaradhya [11] proposes OIDC-A, an OpenID Connect extension for agent identity. Mei et al. [10] treat LLM agents as schedulable processes under an AIOS abstraction. I extend this reasoning to its logical conclusion: if agents are processes, they require coherence protocols at the authorisation layer—not merely authentication, and not merely rate limiting. The central argument is that authorisation revocation in multi-agent delegation chains is operationally equivalent to cache coherence in shared-memory multiprocessors under bounded-staleness semantics. I formalise this equivalence, derive bounded-staleness guarantees for four revocation strategies, and evaluate them through simulation. Contributions. 1. Formal equivalence. A Capability Coherence System (CCS) is defined, with state-mapping function φ from MESI states to authorisation states, preserving transition structure under bounded-staleness semantics (section˜3). 2. Velocity Vulnerability metric. Damage potential of TTL-based approaches is formalised as Vv=v⋅TTLV_v=v·TTL, with proof that this bound is velocity-dependent while operation-count bounds are velocity-independent (section˜3). 3. Operation-bounded credential model. The OpenID Foundation’s execution-count proposal [12] is grounded in release consistency theory [19], demonstrating formal equivalence to acquire/release synchronisation primitives at coherence boundaries (section˜7). 4. Reproducible evaluation. Four strategies evaluated across three scenarios with multi-run statistical aggregation (10 runs, seeds 0–9): 120×120× reduction in unauthorised ops for execution-count vs. TTL in the CRM scenario; 184×184× in the anomaly scenario (section˜8). 2 Theoretical Foundations 2.1 Cache Coherence Essentials Sorin, Hill, and Wood [19] define coherence as the requirement that reads to a memory location return the most recently written value and that writes serialise. The MESI protocol—four stable states (Modified, Exclusive, Shared, Invalid) with well-defined transitions—is the canonical implementation. Between stable states, transient states [19, Ch.6, §6.4.1] (notated XYZXYZ: “was X, transitioning to Y, awaiting event Z”) model in-flight operations; their duration is precisely the damage window in my authorisation analogy. Coherence strategies bifurcate into two classes [19, Ch.2, §2.3]: consistency-agnostic (SWMR-enforcing, synchronous invalidation) and consistency-directed (relaxed, bounded-staleness). GPU architectures [18, 1] adopt the latter, implementing temporal coherence (lease-based self-invalidation) and release consistency (synchronisation-point coherence). The authorisation strategies evaluated in section˜8 map onto these classes exactly. 2.2 Failure Containment Reason’s Swiss Cheese Model [15] holds that failure occurs when independent defensive layers share aligned failure modes. Vijayaraghavan et al. [21] apply this to multi-agent reliability, demonstrating that cascaded critique layers with orthogonal failure modes catch 92.1% of errors. The alignment problem for TTL-based authorisation is structurally identical: the failure mode (temporal window) aligns precisely with the threat vector (operational velocity). Operation-count bounds are orthogonal to velocity—they create the barrier the Swiss Cheese model demands. 2.3 Information-Theoretic Framing Shannon [17] established that reliable communication over a noisy channel requires redundancy at the cost of effective bandwidth. The authorisation channel between authority and agents is noisy (delayed, lossy, potentially Byzantine). Coherence enforcement overhead—re-validation checks, heartbeat signals—is the authorisation-layer equivalent of error-correcting codes: a throughput cost extracted in exchange for revocation reliability. The RCC overhead formula OverheadRCC=Δrevalidation/nOverhead_ RCC= _revalidation/n (section˜8.6) makes this correspondence numerically precise. 3 Formal Model 3.1 Capability Coherence System Definition 3.1 (Capability Coherence System). A Capability Coherence System (CCS) is a tuple ⟨A,C,Σ,δ,α,ℬ⟩ A,C, ,δ,α,B where: • A=a1,…,amA=\a_1,…,a_m\ is a finite set of agents; • C=c1,…,ckC=\c_1,…,c_k\ is a finite set of capabilities (analogous to memory locations); • Σ=M,E,S,I =\M,E,S,I\ is the set of stable authorisation states; • δ:Σ×ℰ→Σδ: ×E→ is the state transition function over events ℰ=,,,E=\grant,revoke,delegate, ,ℎ,introspect,exhaust,expire\; • α:A×C→Σα:A× C→ maps each agent-capability pair to its current authorisation state; • ℬ:Σ→2B: → 2^O is the permitted operations function over operations O. Capability validity maps to cache line validity: s∈M,E,Ss∈\M,E,S\ is a cached block with valid data; I is an invalidated line—no read or write proceeds without a coherence fill from the authority. Formally, ℬ(I)=∅B(I)= , mirroring the hardware constraint precisely. SWMR Adaptation. For any capability c at logical time t: |a∈A:αt(a,c)=M|≤1. |\a∈ A: _t(a,c)=M\ |≤ 1. At most one agent holds delegation-capable state simultaneously; multiple agents may occupy S concurrently. This mirrors the Single-Writer-Multiple-Reader invariant of [19, Ch.2, §2.4]. Definition 3.2 (Authorisation State Machine). The authorisation state machine ℳ=(Σ∪ΣT,ℰ,δ)M=( ∪ _T,E,δ) extends definition˜3.1 with transient states ΣT=EIA,SIA,MIC,ISG,IED _T=\EIA,SIA,MIC,ISG,IED\ following the XYZXYZ notation of [19, Ch.6]. Valid transitions are enumerated in table˜1. Table 1: Valid transitions of the authorisation state machine. From Event To Semantics I grant_shared S Capability issued (role-based) I grant_exclusive E JIT credential issued E delegate M Agent sub-delegates E revoke EIAEIA Revocation in-flight, ACK pending EIAEIA ack I Revocation confirmed S revoke SIASIA Revocation in-flight (shared) M revoke_cascade MICMIC Cascade revocation, sub-agents pending MICMIC all_acks I All delegees confirmed S exhaust I Operation count depleted (RCC) S expire I TTL expired (temporal coherence) Invalid transitions—I→MI→ M (delegation without prior grant), S→MS→ M (bypass of exclusivity upgrade)—are rejected by δ. The transient states are not cosmetic: the duration of EIAEIA and MICMIC is precisely the interval over which unauthorised operations accumulate. Formal analyses that collapse transient states into atomic transitions systematically underestimate the damage window. 3.2 State Mapping Function Definition 3.3 (State Mapping). Let ΣMESI=Mhw,Ehw,Shw,Ihw _ MESI=\M_hw,E_hw,S_hw,I_hw\ [19] and Σauth=M,E,S,I _auth=\M,E,S,I\. The mapping φ:ΣMESI→Σauth : _ MESI→ _auth is: φ(Mhw) (M_hw) =M(write-capable ↦ delegate-capable) =M (write-capable $ $ delegate-capable) φ(Ehw) (E_hw) =E(exclusive read ↦ sole credential holder) =E (exclusive read $ $ sole credential holder) φ(Shw) (S_hw) =S(shared read ↦ role-based pooled access) =S (shared read $ $ role-based pooled access) φ(Ihw) (I_hw) =I(invalid ↦ revoked) =I (invalid $ $ revoked) Figure 1: State mapping φ:ΣMESI→Σauth : _ MESI→ _auth. Left: hardware MESI state machine with transition triggers (BusRd, BusRdX, Snoop-Inv). Right: authorisation state machine with corresponding triggers (grant, delegate, revoke). Transient states as dashed nodes (EIAEIA, MICMIC, ISGISG). Event correspondences labelled on connecting arrows. Claim 3.1 (Structural Equivalence). The mapping φ preserves transition structure: for every valid transition (s1,ehw,s2)(s_1,e_hw,s_2) in the hardware MESI protocol, there exists a corresponding valid transition (φ(s1),eauth,φ(s2))( (s_1),e_auth, (s_2)) in ℳM, where eauthe_auth is the authorisation-domain event corresponding to hardware event ehwe_hw. Proof sketch. Correspondence verified by exhaustive enumeration against [19, Table 6.3]. Hardware BusRd maps to grant_shared; BusRdX to grant_exclusive; Snoop-Invalidate to revoke; Write-back to delegate (scope attenuation). SWMR is preserved by construction (definition˜3.1). ∎ I use structural equivalence rather than isomorphism because the authorisation domain introduces transitions absent from hardware MESI— notably exhaust and expire—and imposes the additional constraint ℎ.⊆.child.scope .scope. The hardware model is a strict subset of the authorisation model, which is architecturally convenient: known hardware bounds carry over as lower-bound estimates for authorisation. Scope of equivalence. CCS establishes an operational equivalence under bounded-staleness semantics, not a semantic isomorphism. Hardware MESI guarantees memory visibility through physical interconnect properties; CCS achieves analogous authorisation visibility through protocol-level strategy constraints. Domain-specific extensions—trust scoring, delegation DAGs, scope attenuation—extend the authorisation model beyond the hardware domain. CCS is a coherence-inspired authorisation protocol; it is not a full MESI instance. 3.3 Damage Bound Functions Definition 3.4 (Velocity Vulnerability). For agent velocity v (ops/tick) and credential TTL Δt t (ticks): Vv(v,Δt)=v⋅Δt.V_v(v, t)=v· t. The significance is not the arithmetic—which is elementary—but that agent velocity emerges as a first-class security parameter: a dimension absent from human-centric IAM literature. Definition 3.5 (Damage Bound). For revocation strategy π, the damage bound DπD_π is the maximum unauthorised operations executable after the authority initiates revocation: Strategy π DπD_π Bound type Eager (consistency-agnostic) Deager≤v⋅ΔnetworkD_eager≤ v· _network Time-bounded, velocity-dependent Lazy (check-on-use) Dlazy≤v⋅(Δnetwork+Δcheck)D_lazy≤ v·( _network+ _check) Time-bounded, velocity-dependent Lease (temporal coherence) Dlease≤v⋅TTLD_lease≤ v·TTL Time-bounded, velocity-dependent Exec-count (RCC) Drcc≤nD_rcc≤ n Operation-bounded, velocity-independent Theorem 3.1 (RCC Safety Bound). In a CCS with execution-count strategy and budget n, the maximum unauthorised operations per capability after revocation initiation is bounded by n, independent of agent velocity v. Proof sketch. Let trt_r be the authority’s revocation time for capability c held by agent a. Let k be operations a has executed against c since the most recent acquire. At budget exhaustion (k=nk=n, the release point), a must contact the authority for a fresh credential (acquire). The authority, having revoked c at trt_r, denies the acquire. Maximum unauthorised operations after trt_r are n−k≤n-k≤ n. Critically, the bound is on operations, not time: a faster agent exhausts n sooner but cannot exceed n. The proof holds regardless of v. ∎ Remark 1 (theorem˜3.1 scope). The bound Drcc≤nD_rcc≤ n applies per capability. In delegation chains where multiple agents hold distinct capabilities with independent budgets, aggregate unauthorised operations across the cascade may vary with stochastic scheduling—the banking scenario (σ=13.0σ=13.0 for exec-count, section˜8.3) is a concrete illustration—but each individual capability respects the deterministic bound. Zero bound violations across all 120 experimental runs (4×10×34× 10× 3 configurations) confirm this without exception. Remark 2 (Distinction from rate limiting). A rate limiter caps throughput; RCC invalidates the credential itself at the operation boundary. Under rate limiting, a revoked agent is throttled but retains a credential it believes valid. Under RCC, the agent discovers revocation at the synchronisation boundary and transitions α(a,c)→Iα(a,c)→ I. The agent cannot resume without a fresh grant—this is acquire semantics. The behavioural distinction is observable in table˜5: RCC is the only strategy that forces re-acquisition (1.0±01.0± 0 revalidations) rather than silently expiring state. Corollary 3.1.1. For eager strategy: Deager=v⋅ΔnetworkD_eager=v· _network. At v=100v=100, Δnetwork=5 _network=5: Deager=500D_eager=500. Eager invalidation approaches zero unauthorised operations only when Δnetwork<1/v _network<1/v—an unattainable condition for realistic high-velocity deployments. 4 Related Work 4.1 Multi-Agent Failure Modes Building on ReAct [25] and AutoGen [24]—which document the transition from singular LLMs to compound agent systems—neither framework treats the authorisation state of individual agents, a gap with direct security consequences. Chain-of-Thought [23] improves reasoning reliability without touching authorisation state. Cemri et al. [5] provide the most comprehensive failure taxonomy to date: MAST (1,600+ traces, seven frameworks) identifies fourteen failure modes across three categories. Their “inter-agent misalignment”—agents diverging from shared expectations—maps directly to the coherence violation I formalise: an agent in perceived state S while the authority has moved it to I. This is stale read semantics at the authorisation layer. 4.2 Organisational Reliability Models Building on [21]—the “Team of Rivals” architecture—I extend their organisational metaphor from semantic coherence (Generator/Critic separation) to security coherence (Execution/Authorisation separation). Huang et al. [9] provide empirical grounding: hierarchical oversight yields 5.5% performance degradation versus 23.7% for flat topologies, and their Inspector mechanism recovers 96.4% of faulty agent errors. The Authority Service in CCS plays the Inspector role at the authorisation layer. The 2–10% RCC overhead (section˜8.6) is commensurate with the Huang et al. benchmark. 4.3 Trust and Security Governance Raza et al. [14] adapt TRiSM for agentic multi-agent systems, defining monitoring metrics (Component Synergy Score, Tool Utilisation Efficacy). Their framework specifies what to monitor; CCS delineates the enforcement mechanism: a declining trust score triggers a concrete state transition S→IS→ I in the state machine. The CSA framework [7] articulates “Continuous Authorisation”—privileges evaluated continuously rather than granted once at session initiation. My architecture instantiates this as a protocol layer through which trust signals become coherence actions. 4.4 Delegation and Authorisation Standards Schwenkschuster et al. [16] formalise cross-domain identity chaining; South et al. [20] provide cryptographic delegation primitives. Both address chain establishment. I address chain teardown—the coherent propagation of revocation across delegation DAGs. Establishment is the easy half of the problem. For scope attenuation, two approaches have emerged: online (RFC 8693 Token Exchange [4]) and offline (Biscuits [3], Macaroons [2]). Both are stateless scope management mechanisms. CCS provides the complementary stateful coherence layer: even when delegation is correctly authenticated and attenuated, temporal consistency of revocation remains—as [12] acknowledges—“largely unsolved.” The two mechanisms are composable, not competing. 5 Authorisation as a Coherence Problem In centralised systems, authorisation is atomic: a single database check yields a binary, current result. In distributed agent systems, authorisation is cached—every token and signed assertion is a cached copy of a permission that existed at t0t_0. The distributed authorisation literature has addressed the performance implications of this caching but has largely neglected the coherence implications. The difficulty of securing agentic systems stems from treating the stale-token problem as a latency problem when it is structurally a coherence problem. In Sorin et al.’s taxonomy [19], coherence protocols manage the propagation of writes (revocations) to all readers (agents). The “write” is a revocation event; the “readers” are agents holding cached credentials. The coherence strategy determines how quickly and at what cost the write propagates. 5.1 Consistency-Agnostic (Eager) Revocation This class enforces SWMR synchronously: the authority invalidates all held tokens before acknowledging the revocation. In hardware terms, this is bus-based snooping. The fragility is structural, not incidental: a single offline agent causes the process to hang or fail open. Cemri et al.’s MAST taxonomy [5] documents “system design issues” as a primary failure category; synchronous revocation introduces precisely this mode at the authorisation layer. Corollary˜3.1.1 adds a further constraint: eager strategies do not achieve zero unauthorised operations when Δnetwork>0 _network>0—at v=100v=100, the 5-tick propagation window admits 500 unauthorised operations regardless of broadcast aggressiveness. 5.2 Consistency-Directed (Relaxed) Revocation The system accepts asynchronous revocation propagation under bounded staleness. The question—where the interesting design space lies—is what bounds the staleness. Temporal coherence (TTL) bounds staleness by time, creating the O(v⋅TTL)O(v·TTL) vulnerability of definition˜3.4. Release consistency (execution-count) bounds staleness by operations, eliminating velocity dependence by theorem˜3.1. The qualitative departure between these two bound types is the central empirical claim of this paper. 6 The MESI Mapping I instantiate φ from definition˜3.3 on the agent authorisation lifecycle (fig.˜1). Each stable state carries a concrete operational semantics: Modified → Delegated Authority. The agent holds delegation rights—in Biscuit/Macaroon terms [3, 2], it can append attenuation caveats. Revocation from M requires cascade notification: M→_MICM revoke\_cascadeMIC. The in-flight MICMIC interval is where cascade damage accumulates. Exclusive → JIT Access. Single-use credential; no sharing. Maps to CSA “Just-in-Time Access” [7]. The credential exists for exactly the task duration—the shortest possible DπD_π window for time-bounded strategies. Shared → Role-Based Pooling. Multiple agents hold read-only copies simultaneously (e.g., “Read S3 Bucket”). Default state for most OAuth access tokens. Staleness risk is multiplicative: all copies are stale until individually invalidated. Invalid → Revoked. ℬ(I)=∅B(I)= . The agent cannot proceed without a coherence transaction. The transient state EIAEIA—revocation sent, ACK pending—is where the bulk of damage occurs in eager strategy deployments. Formal analyses that treat revocation as instantaneous systematically underestimate the damage window by omitting this interval. 7 Architecture 7.1 Execution-Count Bounds as Release Consistency In GPU release consistency [19, 1, Ch.10, §10.1.4], coherence is enforced at synchronisation points: acquire loads fresh state, release commits and exposes writes. Between these boundaries, the processor operates on its local cache without coherence traffic. An operation budget n is issued with each credential. Each operation decrements a counter. At k=nk=n—budget exhaustion, the release point—the agent contacts the authority for a fresh credential (acquire). If the capability was revoked during the n-operation critical section, the acquire is denied. By theorem˜3.1, the damage is bounded at n regardless of v. The OpenID Foundation [12] independently proposes “credentials constrained by execution counts.” I demonstrate this is formally equivalent to release/acquire cycles: each n-operation block is a critical section bounded by acquire (credential refresh) and release (budget exhaustion). To my knowledge, this equivalence has not been stated in the authorisation literature; it is the key theoretical contribution enabling transfer of hardware coherence bounds to the authorisation domain. 7.2 Authority Service The Authority Service combines a Policy Decision Point (PDP) [8] with a coherence directory controller: 1. Capability Registry. Ground truth of all active capabilities, delegation DAGs, and scope attenuation chains. Enforces ℎ.⊆.child.scope .scope as a hard invariant. (Under network partition, the registry may diverge from agents’ cached views; see section˜9.2.) 2. Trust Scorer. Implements CSA continuous authorisation [7] and Raza et al.’s TRiSM monitoring [14]. Behavioural analytics produce dynamic trust scores; score below threshold τ<0.4τ<0.4 triggers automatic revocation: α(a,c)→I∀c∈Caα(a,c)→ I\ ∀\,c∈ C_a. The threshold τ is treated as scenario-fixed; sensitivity analysis across τ∈[0.2,0.6]τ∈[0.2,0.6] is deferred. 3. Revocation Broadcaster. Snooping-style broadcast for ≤25≤ 25 agents; directory-based unicast for larger populations [19, Ch.6, §6.4.3]. The snooping-to-directory crossover was not empirically validated in this study—flagged as a pending calibration item. 7.3 Heterogeneous Coherence Building on compound consistency models in CPU+GPU systems [19, Ch.10, §10.2], different agent classes operate under different strategies. Strategy assignment maps directly from the consistency class taxonomy: high-integrity operations (financial transactions) require consistency-agnostic semantics (eager); high-throughput operations (bulk CRM updates) tolerate consistency-directed relaxation (lease, exec-count). Each device operates under its own consistency model; the Authority Service provides cross-domain ordering—the global coherence controller. Table 2: Heterogeneous coherence strategy assignment by agent context. Agent Context Coherence Strategy Damage Bound Hardware Analogy Financial ops Eager (consistency-agnostic) ≤v⋅Δnet≤ v· _net CPU SWMR CRM / Bulk sync Lease-based (temporal) ≤v⋅TTL≤ v·TTL GPU Temporal Analytics Lazy (check-on-use) ≤v⋅Δcheck≤ v· _check Weak ordering High-velocity API Exec-count (RCC) ≤n≤ n ops GPU Release Consistency Figure 2: Heterogeneous Coherence Architecture. Authority Service (central) connected to four agent clusters, each labelled with coherence strategy. Message types: synchronous (eager, solid), periodic (lease, dashed), on-demand (lazy, dotted), acquire/release (exec-count, double). Trust Scorer feeds risk assessments into the strategy selector. 8 Evaluation 8.1 Simulation Methodology A tick-based discrete event simulator was implemented in Python 3.11. Each tick is an indivisible scheduling unit; all operations within a tick are logically simultaneous. The tick abstraction isolates coherence dynamics from deployment-specific latencies. To map to a specific deployment, tick counts are multiplied by the deployment’s scheduling interval (e.g., one tick =10=10 ms implies 5-tick latency =50=50 ms). Methodological caveat. The tick simulator introduces a minor temporal aliasing artefact when operations cluster at tick boundaries. In probabilistic scheduling scenarios (Banking, Anomaly), operations at p=0.5p=0.5 and p=0.7p=0.7 are resolved by independent Bernoulli draws per agent per tick. For the deterministic CRM scenario (v=100v=100 ops/tick constant), tick alignment eliminates this concern entirely and produces σ=0σ=0 across all seeds—which is correct but deserves explicit acknowledgment rather than being reported as a surprising result. Algorithm 1 Simulation Engine 1:scenario config S, strategy π, max_ticks T 2:metrics M 3:Initialise AuthorityService, AgentSet from S 4:Initialise MetricsCollector 5:for t=1t=1 to T do 6: for all agent a∈AgentSeta∈ AgentSet do ⊳ Phase 1: Agent operations 7: ←determine_action_count(a,S,t)attempts← determine\_action\_count(a,S,t) 8: for all attempt do 9: ←random_capability(a)cap← random\_capability(a) 10: result←a.attempt_operation() result← a. attempt\_operation(cap) 11: if .actually_revoked_at_authority()cap. actually\_revoked\_at\_authority() then 12: M.unauthorized_count+=1M. unauthorized\_count +=1 13: end if 14: if π=RCCπ= RCC and a.ops_remaining=0a. ops\_remaining=0 then 15: a.request_revalidation()a. request\_revalidation() ⊳ acquire 16: end if 17: end for 18: end for 19: for all pending revocation r do ⊳ Phase 2: Authority processing 20: if π=Eagerπ= Eager then 21: broadcast_and_await_ack(r)(r) 22: else if π=Lazyπ= Lazy then 23: mark_revoked(r)(r) 24: else if π=Leaseπ= Lease then 25: mark_revoked(r)(r) 26: else if π=RCCπ= RCC then 27: mark_revoked(r)(r) 28: end if 29: end for 30: deliver_messages(latency=S.latency_ticks)(latency=S. latency\_ticks) ⊳ Phase 3: Network delivery 31: for all agent a do ⊳ Phase 4: Anomaly detection 32: if trust_scorer.check_anomaly(a)(a) then 33: revoke_all_capabilities(a)(a) 34: end if 35: end for 36: for all agent a with transient state do ⊳ Phase 5: Resolve transients 37: if ack_received(a)(a) then 38: a.state←stable_target(a.transient_state)a. state← stable\_target(a. transient\_state) 39: end if 40: end for 41: M.record_tick(t,AgentSet)M. record\_tick(t, AgentSet) ⊳ Phase 6: Metrics 42:end for 43:return M.aggregate()M. aggregate() Multi-run aggregation. Each strategy-scenario configuration is executed 10 times with deterministic seeds 0–9. Population mean and population standard deviation σ (not sample s) are reported, since the 10 runs constitute the complete experimental population under the specified seed range. All scenario configurations are published as YAML files alongside the source code at https://github.com/hipvlady/prizm. 8.2 Scenario Configurations Table 3: Simulation parameters across three business-contextualised scenarios. Parameter Scenario 1 (Banking) Scenario 2 (CRM) Scenario 3 (Anomaly) Agents 10 1 5 Delegation depth 3 1 1 Action model Prob. (p=0.5p=0.5) Det. (100/tick) Prob. (p=0.7p=0.7) Seeds 0–9 (10 runs) 0–9 (10 runs) 0–9 (10 runs) Network latency 10 ticks 5 ticks 10 ticks Revocation trigger Tick 100 Tick 0 Auto (trust score) TTL (lease, ticks) 120 60 3,000 Exec-count n 60 50 100 Lazy check interval 40 ticks 23 ticks 10 ticks Anomaly burst N/A N/A 12 ops/tick Trust threshold τ 0.8 0.8 0.4 Trust decay 0.3 0.3 0.5 Duration (ticks) 200 120 300 8.3 Scenario 1 — Banking Cascade Revocation A payment processing agent is compromised at tick 100. A three-level delegation chain (User → A → B → C) requires cascade revocation. Probabilistic scheduling (p=0.5p=0.5) produces genuine cross-seed variance. Table 4: Banking cascade results (mean ± σ, 10 runs, seeds 0–9). Metric Eager Lease (120-tick) Lazy (40-tick) RCC (n=60n=60) Unauthorised ops 14.9±3.214.9± 3.2 29.9±2.629.9± 2.6 35.3±2.935.3± 2.9 32.3±13.032.3± 13.0 Staleness max (ticks) 10.0±010.0± 0 20.0±020.0± 0 23.0±023.0± 0 37.0±21.637.0± 21.6 Messages sent 3.0±03.0± 0 3.0±03.0± 0 3.0±03.0± 0 3.0±03.0± 0 Bound violations 0 0 0 0 Eager achieves the tightest observed bound (14.9±3.214.9± 3.2)—but the non-zero value deserves direct acknowledgment. The 10-tick network latency across 10 agents in a 3-level delegation tree admits operations during propagation, consistent with corollary˜3.1.1. Eager does not achieve zero; it achieves v⋅Δnetworkv· _network in expectation. RCC exhibits the highest variance (σ=13.0σ=13.0). This is not a violation of theorem˜3.1: the theorem bounds D≤nD≤ n per capability, and zero bound violations confirm every individual capability respected its budget. The variance arises from an interaction between release/acquire boundaries at different delegation depths and stochastic action scheduling—depending on the seed, different agents exhaust their budgets at different points relative to the cascade propagation wavefront. The phenomenon is stochastic staleness within the bound, not stochastic violations of the bound. The proximity of all strategies (14.9–35.3 range) reflects the low effective velocity under probabilistic scheduling. The CRM scenario (section˜8.4) is designed to maximally expose velocity dependence. 8.4 Scenario 2 — CRM High-Velocity Agent A sales synchronisation agent operates at 100 ops/tick. Credential revoked at tick 0—worst case: the entire simulation window is post-revocation. Table 5: CRM high-velocity results (mean ± σ, 10 runs, seeds 0–9). Metric Eager Lease (60 ticks) Lazy (23-tick) RCC (n=50n=50) Unauthorised ops 500.0±0500.0± 0 ,000.0±6,000.0± 0 2,400.0±02,400.0± 0 50.0±50.0± 0 Staleness max (ticks) 5.0±05.0± 0 60.0±060.0± 0 24.0±024.0± 0 0.0±00.0± 0 Revalidation count 0.0±00.0± 0 0.0±00.0± 0 0.0±00.0± 0 1.0±01.0± 0 Bound violations 0 0 0 0 σ=0σ=0 across all strategies and all seeds—a direct consequence of deterministic scheduling (v=100v=100 constant). The zero variance is a confirmatory result: it proves that damage bounds from definition˜3.5 are exact, not stochastic approximations. Table 6: Predicted vs. observed damage bounds (CRM scenario). Strategy Predicted DπD_π Observed Match Eager: v⋅Δnet=100×5v· _net=100× 5 500 500.0±0500.0± 0 Exact Lazy: v⋅(Δnet+Δcheck)=100×(1+23)v·( _net+ _check)=100×(1+23) 2,400 2,400.0±02,400.0± 0 Exact Lease: v⋅TTL=100×60v·TTL=100× 60 6,000 6,000.0±06,000.0± 0 Exact RCC: n 50 50.0±050.0± 0 Exact (theorem˜3.1) The 120×120× reduction from lease to RCC (6,000→506,000→ 50) is the central empirical result (fig.˜3). TTL damage scales O(v⋅TTL)O(v·TTL); RCC damage is capped at O(n)O(n) regardless of velocity. Eager achieves a 12×12× improvement over lease—but this is still an order of magnitude above RCC, and it imposes synchronous coupling that introduces availability risk (section˜5). Figure 3: Unauthorised operations by strategy (Scenario 2, log scale). CRM high-velocity scenario (100 ops/tick, 10 runs, σ=0σ=0). The 120×120× gap between Lease and RCC is annotated. Y-axis logarithmic; damage bound formulae shown below each bar. 8.5 Scenario 3 — Anomaly Auto-Revocation Agent behaviour bifurcates to burst mode (12 ops/tick) at tick 50. No explicit revocation is issued; the Trust Scorer detects the anomaly, drops the trust score below τ=0.4τ=0.4, and triggers automatic revocation. Table 7: Anomaly auto-revocation results (mean ± σ, 10 runs, seeds 0–9). Metric Eager Lazy Lease (3000-tick) RCC (n=100n=100) Unauthorised ops 108.0±0108.0± 0 10.8±3.610.8± 3.6 ,950.8±3.62,950.8± 3.6 16.0±3.716.0± 3.7 Staleness max (ticks) 10.0±010.0± 0 1.9±0.31.9± 0.3 245.9±0.3245.9± 0.3 1.8±0.41.8± 0.4 Cascade completeness 1.0 1.0 0.0 1.0 RCC achieves a 184×184× reduction against lease TTL (16.0±3.716.0± 3.7 vs. 2,950.8±3.62,950.8± 3.6), consistent with the velocity-independence guarantee of theorem˜3.1 under dynamic revocation triggers. The counterintuitive result: lazy outperforms eager (10.8±3.610.8± 3.6 vs. 108.0±0108.0± 0). Eager’s synchronous blocking during revocation propagation delays the revocation signal processing while the agent continues operating on its cached credential. The Trust Scorer triggers revocation; the lazy agent’s next check falls within its 10-tick check interval—only 1.9±0.31.9± 0.3 ticks of staleness. The eager agent, by contrast, accumulates 108 unauthorised operations during the 10-tick broadcast across 5 agents, compounded by the 12 ops/tick burst rate during the anomaly window. This result demonstrates that the four strategies do not form a simple linear ranking whose ordering is preserved across scenarios. Strategy effectiveness is topology-dependent. Lazy check intervals shorter than network propagation latency are advantageous under trust-triggered revocation; the same check interval would be disastrous under high-velocity deterministic scheduling (CRM: Lazy =2,400=2,400 vs. RCC =50=50). The RCC result (16.0±3.716.0± 3.7) is the reliable backstop: regardless of which strategy performs better in a specific topology, RCC provides a bounded ceiling. The Lease strategy’s cascade completeness of 0.0 is a clean result: with a 3,000-tick TTL and a 300-tick simulation, no lease expires within the simulation window. The agent never self-invalidates. 8.6 Cost-Benefit Analysis Theoretical revalidation overhead for RCC: OverheadRCC=Δrevalidationn.Overhead_ RCC= _revalidationn. With Δrevalidation=1 _revalidation=1 tick (local re-auth) and n=50n=50: overhead =2.0%=2.0\% of operations require a re-validation round-trip. At n=10n=10: overhead =10.0%=10.0\%. Overhead is inversely proportional to n, instantiating a tunable security-performance knob. At n<5n<5, overhead approaches eager-strategy levels, eliminating the consistency-directed advantage. Table 8: Strategy comparison summary. Strategy Damage Bound Deterministic? Vel.-Independent? Coupling Eager v⋅Δnetv· _net Yes No Synchronous Lease v⋅TTLv·TTL Yes No None Lazy v⋅(Δnet+Δcheck)v·( _net+ _check) Yes No On-demand RCC n Yes Yes Acquire/release RCC is the only strategy whose damage bound is independent of both agent velocity and network latency while avoiding synchronous coupling. 9 Discussion 9.1 Scope and Applicability The operational equivalence of ˜3.1 holds under bounded-staleness semantics for the core MESI states and transitions. The authorisation domain’s extensions—scope attenuation, trust-based revocation, hierarchical delegation DAGs—strictly extend the hardware model. Hardware bounds function as lower-bound estimates, not tight characterisations. Huang et al.’s [9] empirical support—hierarchical oversight recovers 96.4% of faulty errors at 5.5% overhead—grounds the overhead-for-safety trade inherent in coherence enforcement. The 2–10% RCC overhead is the authorisation-layer equivalent. This alignment is suggestive; I resist overclaiming, since the Huang et al. setting (semantic error recovery) and the CCS setting (authorisation state coherence) are related by analogy, not by formal equivalence. 9.2 Limitations Authority centralisation. CCS assumes authority consistency strictly stronger than agent consistency—the reliable directory controller assumption of NUMA coherence [19, Ch.6, §6.4.3]. Under network partition, agents operating on cached credentials remain within their strategy bounds: exec-count agents are bounded by remaining operations regardless of authority reachability. Authority recovery follows directory controller failover: pending revocations are replayed from a durable event log. Split-brain scenarios are deferred to future work on replicated authority services. Adversarial scheduling. The evaluation uses deterministic seeds under fair scheduling. RCC bounds the quantity of unauthorised operations, not their semantic impact. A strategic adversary could select which n operations to execute for maximum damage—a capability with no hardware analogy but entirely plausible for a compromised agent acting on learned objectives. Adversarial operation scheduling within the execution budget is an open problem. Simulation scale. Three scenarios, 1–10 agents, delegation depths 1–3. Production systems introduce Byzantine failures, network partitions, and heterogeneous identity providers. Stress testing at 100+ agents is future work; the snooping-to-directory transition heuristic requires empirical calibration at that scale. Tick abstraction. Logical ticks abstract wall-clock time. The relative comparisons (120×120×, 184×184× reductions) hold regardless of tick-to-time mapping; absolute timing claims require a deployment-specific mapping. Formal verification. ˜3.1 is verified by exhaustive transition enumeration, not by mechanised proof. A TLA+ specification would enable model checking of safety (no unauthorised operations after acquire) and liveness (all agents eventually reach consistent state). This is the primary formalisation avenue for future work. Context contamination. Credential revocation does not revoke knowledge. An agent that read 50 records retains that context. Revocation is necessary but not sufficient for full containment. Emerging standards. Integration with OIDC-A [11], SCIM Agentic Schema [22], and identity chaining [16] requires protocol-level formalisation as those standards mature. 10 Conclusion Authorisation revocation in multi-agent delegation chains is operationally equivalent to cache coherence in shared-memory multiprocessors under bounded-staleness semantics. The formal model (section˜3) establishes this through explicit state mapping, a safety theorem, and damage bound analysis. TTL-based approaches yield velocity-dependent damage scaling as O(v⋅TTL)O(v·TTL). Execution-count bounds (RCC) yield a velocity-independent, deterministic bound of n operations per capability (theorem˜3.1)—enforcing coherence at synchronisation boundaries rather than rejecting individual operations. Tick-based simulation across three scenarios (120 total runs) confirms: predicted bounds from definition˜3.5 match observed values exactly across all deterministic configurations; RCC achieves 120×120× reduction versus TTL in the CRM scenario and 184×184× in the anomaly scenario; zero bound violations across all 120 runs confirm the per-capability scope of theorem˜3.1. High-velocity agents—any autonomous system executing above approximately 10 ops/second—should not hold time-bounded credentials. Operation-bounded credentials force periodic re-authorisation at boundaries defined by n, ensuring that revocation is discovered within a bounded number of operations irrespective of how fast the agent operates. References [1] J. Alsop et al. (2016) Lazy release consistency for GPUs. In Proceedings of the 49th IEEE/ACM International Symposium on Microarchitecture (MICRO), Cited by: §2.1, §7.1. [2] A. Birgisson, J. G. Politz, A. Taly, M. Vaziri, and M. Liskov (2014) Macaroons: cookies with contextual caveats for decentralized authorization in the cloud. In Proceedings of the 21st Network and Distributed System Security Symposium (NDSS), Cited by: §4.4, §6. [3] Biscuit Security (2024) Biscuit: authorization tokens with decentralized verification. Note: https://w.biscuitsec.org/ Cited by: §4.4, §6. [4] B. Campbell, J. Bradley, N. Sakimura, and D. Tonge (2020) OAuth 2.0 token exchange. RFC Technical Report 8693, IETF. External Links: Link Cited by: §4.4. [5] M. Cemri, M. Z. Pan, S. Yang, L. A. Agrawal, B. Chopra, R. Tiwari, K. Keutzer, A. Parameswaran, D. Klein, K. Ramchandran, M. Zaharia, J. E. Gonzalez, and I. Stoica (2025) Why do multi-agent LLM systems fail?. Note: arXiv preprint arXiv:2503.13657 Cited by: §4.1, §5.1. [6] A. Chan, N. Kolt, P. Wills, U. Anwar, C. Schroeder de Witt, N. Rajkumar, L. Hammond, D. Krueger, L. Heim, and M. Anderljung (2024) IDs for AI systems. Note: arXiv preprint arXiv:2406.12137 Cited by: §1. [7] Cloud Security Alliance (2025) Agentic AI identity management approach. Note: https://cloudsecurityalliance.org/blog/2025/03/11/agentic-ai-identity-management-approach Cited by: §4.3, §6, item 2. [8] V. C. Hu, D. Ferraiolo, R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller, and K. Scarfone (2014) Guide to attribute based access control (ABAC) definition and considerations. Special Publication Technical Report 800-162, NIST. Cited by: §7.2. [9] J. Huang, J. Zhou, T. Jin, X. Zhou, Z. Chen, W. Wang, Y. Yuan, M. R. Lyu, and M. Sap (2024) On the resilience of multi-agent collaboration with faulty agents. Note: arXiv preprint arXiv:2408.00989 Cited by: §4.2, §9.1. [10] K. Mei, X. Zhu, W. Xu, W. Hua, M. Jin, Z. Li, S. Xu, R. Ye, Y. Ge, and Y. Zhang (2024) AIOS: LLM agent operating system. Note: arXiv preprint arXiv:2403.16971 Cited by: §1. [11] S. Nagabhushanaradhya (2025) OpenID connect for agents (OIDC-A) 1.0: a standard extension for LLM-based agent identity and authorization. Note: arXiv preprint arXiv:2509.25974 Cited by: §1, §9.2. [12] OpenID Foundation (2025) Identity management for agentic AI. Note: https://openid.net/wp-content/uploads/2025/10/Identity-Management-for-Agentic-AI.pdf Cited by: item 3., §1, §4.4, §7.1. [13] Oso (2025) Setting permissions for AI agents. Note: https://w.osohq.com/learn/ai-agent-permissions-delegated-access Cited by: §1. [14] S. Raza, R. Sapkota, M. Karkee, and C. Emmanouilidis (2025) TRiSM for agentic AI governance: a review of trust, risk, and security management in LLM-based agentic multi-agent systems. Note: arXiv preprint arXiv:2506.04133 Cited by: §4.3, item 2. [15] J. Reason (2000) Human error: models and management. BMJ 320 (7237), p. 768–770. Cited by: §2.2. [16] A. Schwenkschuster, P. Kasselman, K. Burgin, M. J. Jenkins, and B. Campbell (2024) Identity and authorization chaining across domains. Note: IETF Internet-Draft, https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/ Cited by: §4.4, §9.2. [17] C. E. Shannon (1948) A mathematical theory of communication. The Bell System Technical Journal 27 (3), p. 379–423. Cited by: §2.3. [18] I. Singh et al. (2013) Cache coherence for GPU architectures. IEEE Micro 33 (4). Cited by: §2.1. [19] D. J. Sorin, M. D. Hill, and D. A. Wood (2020) A primer on memory consistency and cache coherence. 2nd edition, Synthesis Lectures on Computer Architecture, Morgan & Claypool. Cited by: item 3., §2.1, §2.1, §3.1, §3.2, Definition 3.2, Definition 3.3, §5, item 3, §7.1, §7.3, §9.2. [20] T. South, S. Marro, T. Hardjono, R. Mahari, C. Deslandes Whitney, D. Greenwood, A. Chan, and A. Pentland (2025) Authenticated delegation and authorized AI agents. Note: arXiv preprint arXiv:2501.09674 Cited by: §4.4. [21] G. Vijayaraghavan et al. (2026) If you want coherence, orchestrate a team of rivals: multi-agent models of organizational intelligence. Note: arXiv preprint arXiv:2601.14351 Cited by: §2.2, §4.2. [22] M. Wahl (2024) System for cross-domain identity management: agentic identity schema. Note: IETF Internet-Draft, https://datatracker.ietf.org/doc/draft-wahl-scim-agent-schema/ Cited by: §9.2. [23] J. Wei et al. (2022) Chain-of-thought prompting elicits reasoning in large language models. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §4.1. [24] Q. Wu et al. (2023) AutoGen: enabling next-gen LLM applications via multi-agent conversation. Note: arXiv preprint arXiv:2308.08155 Cited by: §4.1. [25] S. Yao et al. (2023) ReAct: synergizing reasoning and acting in language models. In International Conference on Learning Representations (ICLR), Cited by: §4.1.

Instant research discovery