01 / Purpose
Authority must remain effective at the point of action.
Institutions delegate work to AI systems while retaining responsibility for what those systems do. Recording an approval or a stop instruction does not establish what happened next. node&norm investigates the conditions under which authority has practical force, and what evidence supports that conclusion.
Frontier-AI assurance is the direction. AGI readiness is a longer-term purpose. The program prioritizes one narrow investigation at a time, with explicit boundaries between design, instrument qualification, agent-system evaluation and institutional claims.
Current focus: revocation. Initial deterministic measurement qualification completed. Agent-system evaluation, novelty and broader control effectiveness remain unestablished.
Research approach and intended impact
Identify a control risk → test a proposed control → preserve inspectable evidence → inform a practical decision.
The work aims to support three routes to impact:
Evidence for decision-makers
Translate findings into clear accounts of what a test establishes, which assumptions it depends on and what remains unknown. For organizational leaders, engineers and assurance teams, the intended benefit is a firmer basis for design, procurement and deployment questions, with uncertainty visible alongside each result.
Reproducible methods and shared practice
Develop versioned test specifications, comparison controls, failure cases and traceability records that other researchers can inspect. If materials are released, others could reproduce the checks and challenge their interpretation. Comparisons under matching conditions could inform shared evaluation practices and future discussions of assurance requirements.
Technical collaboration with labs and businesses
Seek collaborators to review a method, attempt a replication or contribute a bounded test environment. Each study would agree the system boundary, comparison conditions, evidence access and reporting terms before testing. The goal is to identify specific control weaknesses and assess proposed mitigations under documented conditions.
For the revocation study, a useful first collaboration would review the test contract and identify a matching implementation for a justified replication or a specific unanswered revocation question. Agent-system evaluation would require a further agreed study design.
node&norm welcomes expressions of interest from research labs and businesses willing to examine that question.
02 / Risks and controls
Follow the risk into the control being tested.
Understanding the risk
A previously issued permission may remain usable after authority is withdrawn. Queued work, handoffs and retries can carry that stale permission toward a protected effect.
Evaluating the control
Specify when withdrawal becomes effective, enforce current authority at the effect boundary, and observe whether a protected action actually commits.
These are two perspectives on the same active investigation. Evidence trust and the scaling limits of oversight remain deferred research questions. Qualifying the current observer and checker does not activate those broader studies.
External mediation, authority binding and transaction ordering are candidate control mechanisms to examine under stated assumptions. Their presence alone does not establish a non-bypassable control or a trustworthy deployment.
03 / Current study
Revocation in Delegated AI Workflows
Illustrative security scenario
Can a pending access change still go through after permission is withdrawn?
A critical service is down. An AI operations assistant delegates a request for temporary administrator access to help restore it.
Work is pending
The access request has been delegated, but administrator access is not yet active.
Permission is withdrawn
A security lead stops the request, and the control records the withdrawal.
This is the point we examine
Can the pending request still activate access?
Could its earlier permission still produce a new grant?
- Risk being examined
- The grant takes effect after withdrawal.
- Required control behavior
- The new grant is blocked.
Abstract
Does withdrawing permission prevent new protected actions while delegated work remains unfinished? The current model-free qualification examines one authority root, one parent-to-child delegation edge and an observable commit boundary. It compares deliberately stale admission-only permission with transaction-bound authority checking. Retained source, results and corrections have been inspected. This is a qualified finite testing instrument; autonomous-agent behavior and novelty remain unestablished.
Problem statement
Permission granted earlier can outlive the authority that justified it. What prevents that permission from producing a new protected effect after withdrawal?
Research focus
We examine whether permission withdrawn from a workflow can still produce a new protected change. A request accepted earlier must not authorize a new change after the control records withdrawal.
Two sequences explain the test
When did access actually change?
Follow each sequence in order.
1. Access was already active
Allowed under this timing test- Access becomes active
- Withdrawal takes effect
- Confirmation arrives later
The confirmation reports a change that already happened. Removing access already granted is a separate control requirement.
2. New access becomes active after withdrawal
Failure under this timing test- Request accepted earlier
- Withdrawal takes effect
- New access becomes activeUsing earlier permission
The pending request produces a new change after withdrawal. This is the failure the control must prevent.
The test checks when the change actually happened, separately from when a request was accepted or its confirmation arrived. Comparisons must use the same definition of when withdrawal takes effect.
04 / Methods
How we test whether withdrawal works.
The current qualification uses scripted workers and a local database. We run the same delegated task under two permission-checking rules, then inspect the recorded changes.
Risks these tests examine
- Pending delegated work may still act on permission after withdrawal takes effect.
- A retry may reuse that earlier permission and produce a new protected change.
- A run may look like a successful stop even though a required step was skipped or the request was rejected for an unrelated reason.
The third risk concerns qualification of this test instrument. The broader evidence-trust investigation remains deferred.
What changes between the two tests?
| Comparison | Earlier permission reusedIntentionally weak comparison | Current permission checkedWith the protected change |
|---|---|---|
| Held constant | Same task, worker roles, permitted changes, other permission checks and event order. | Same task, worker roles, permitted changes, other permission checks and event order. |
| Permission validity | Reuses its earlier successful check. | Rechecks active authority inside the same database transaction as the protected change. |
| Question tested | Can earlier permission still produce a new change after withdrawal? | Does checking current permission prevent that change after withdrawal? |
Both rules retain the same checks on who may act, what may change and which request is being processed. Withdrawal is recorded within the same database ordering used for protected changes.
Evidence-checking sequence
How do we know what happened?
Run a fixed scenario
Set the event order in advance and run the case under each permission rule.
Inspect recorded changes
A separate read-only process reads saved database events and the protected record.
Check the event order
An offline checker tests record consistency and whether a new protected change occurred after recorded withdrawal.
Confirm the intended test ran
Verify the planned steps and confirm that each rejection had the expected cause.
“Nothing changed” is not enough.
A run can still fail qualification if a planned step was skipped, a request was rejected for the wrong reason, or evidence is incomplete.
What situations do the tests cover?
| Situation | Question examined | Fixed schedules |
|---|---|---|
| Normal work | Does useful work complete while permission is valid? | 1 |
| Withdrawal while work is pending | Can a child worker still make a new change after withdrawal? | 1 |
| Confirmation arrives later | Is a completed change distinguished from its later confirmation? | 1 |
| Retried requests | Can repeated attempts reuse withdrawn permission? | 1 |
| Requests that should be rejected | Are requests that lack the required authority refused for the correct reason? | 5 |
9 fixed schedules × 2 permission rules = 18 configured test cases.
These cases, called fixtures, are not independent research samples. The retry case contains three attempts at one logical operation.
Implementation details and test assumptions
Understanding the failure mechanism
Bind permission to a defined task, authority root, epoch, principal, scope and protected effect. State when withdrawal becomes durable. An action admitted earlier can still violate the stronger contract if its effect commits after that fence.
One edge of delegated authority
In v0.2, a parent worker requests a child grant from the gateway. The gateway issues a child-owned grant with inherited root and epoch, restricted scope and no further delegation right. The parent delivers its token to the registered child, which prepares and requests the effect through its own mapped IPC channel. The gateway derives principal identity from the channel, not a worker’s identity claim.
Workers do not open the database or contain the enforcement implementation. Gateway code owns protected writes. This is separation of code paths under a trusted host, not operating-system confinement of a malicious worker. Tokens are deterministic fixture identifiers, not cryptographic credentials.
Matched controls and fixed schedules
Both arms apply the same owner, scope and ticket checks. The intentionally weak arm reuses its earlier successful freshness admission. The commit-fenced arm rechecks root activity and epoch within the same SQLite write transaction as the protected effect. Revocation and grant issuance serialize in that same database transaction domain.
Nine schedules under each arm cover useful work without withdrawal; revocation before child commit; a legitimate pre-fence commit with a delayed application acknowledgment; bounded retry; and five rejection controls for scope, identity, grant ownership, scope-expanding delegation and grant issuance after revocation. Barriers fix causal ordering without sleep-based timing assumptions.
Observe commits and qualify the treatment
A separate read-only observer reads committed database events and sink rows. An offline checker assesses consistency and the no-post-fence-effect endpoint without importing the gateway’s enforcement predicate. A separate qualification step checks that the intended steps and exact denial causes occurred. A zero-effect result can fail this treatment check.
The gateway responds after transaction commit. The late-acknowledgment control delays a separate application acknowledgment; it does not delay the gateway’s execution response. Child-token delivery is evidenced by worker and harness records, not independently witnessed by the database observer.
Missing or malformed evidence cannot qualify as a clean stop. Failures, incomplete episodes, source versions and corrections remain in the record. An unexpected protected effect requires a retained witness and diagnosis before continuation.
Conditional agent-system evaluation
An adaptive-versus-scripted comparison proceeds only if it can answer a remaining informative question under matched tools, authority and budgets. A correct complete mediator should prevent realized unauthorized effects for either executor. Denied attempts cannot replace the committed-effect endpoint. A later model phase requires separate design and authorization.
Agent-system evaluation remains conditional
A future comparison of AI-driven and scripted workers would proceed only if it answers a justified remaining question under matched conditions. It requires a separate study design and authorization.
05 / Observations
What the recorded tests showed.
These observations come from retained v0.2 records for scripted workers and a local database. The cloud-access scenario above is an illustration.
Example from the completed local qualification
One fixed scenario, run under two permission rules, recorded withdrawal before the child attempted the protected database change. Reusing earlier permission allowed one new change. The transactional check refused the request for the specified withdrawal reason and recorded no protected change.
Recorded case: C1, v0.2. Website preparation inspected this evidence; it did not rerun the case.
Recorded local database outcomes
| Situation | Earlier permission reusedIntentionally weak comparison | Current permission checkedWith the protected change |
|---|---|---|
| Withdrawal before the pending change | A new database change occurred after withdrawal. | Refused because permission was withdrawn; no new change. |
| Retries after withdrawal | Three attempts produced one new database change. | All three attempts refused; no new database change. |
| Valid work without withdrawal | Work completed. | Work completed. |
| Change completed before withdrawal; confirmation later | Correctly treated as a change completed before withdrawal. | Correctly treated as a change completed before withdrawal. |
| Five authority-rejection controls | Rejected for their specified reasons. | Rejected for their specified reasons. |
The retained final run and a separate AI-assisted replay each matched all 18 expected case outcomes, including deliberately induced failures in the weak comparison. The records report 19 current unit tests passing; the same tests were invoked two ways and counted once.
These fixed cases are not independent research samples or failure-rate estimates. Website preparation inspected source and retained records; it did not rerun the qualification or review.
What review caught and corrected
Review constructed three counterexamples that the initial checker wrongly accepted. The corrections strengthened what qualifies as a valid test.
| What the initial checker accepted | What the corrected checker requires |
|---|---|
| A valid request after withdrawal was refused for an unrelated scope error. | Require the expected withdrawal-related rejection reason. |
| Child work appeared even though permission for that child had been refused. | Require evidence that the child’s permission was issued before the later step can qualify. |
| An action attempt appeared after its preparation step had been refused. | Require successful preparation before the later attempt can qualify. |
These counterexamples exposed false acceptance by the checker. They did not establish that workers bypassed the control. The earlier source, counterexamples and corrections remain preserved.
Traceability and preservation
Selected decisions, substantive AI contributions, sources, artifacts, corrections and open questions are linked in a structured research record. The workbook, tables and notebook provide related views or copies of that record. Their agreement preserves consistency between copies; it does not independently confirm an experimental result. The record remains editable and selective.
Technical results, correction history and inspection notes
Current qualification v0.2
The retained final run and separate AI-assisted replay each record 18 case-arm fixtures matching their declared expectations: nine fixed schedules × two arms. They record 19 current unit tests passing. Discovery and direct invocation exercise the same 19 tests; they do not create 38 distinct tests.
The seeded admission-only arm committed post-fence effects in the revocation and retry schedules. The commit-fenced arm denied them. Both arms allowed useful work without revocation and legitimate pre-fence effects. The five negative-control schedules per arm were required to reject for their specified causes.
These are fixed engineering checks, not independent research samples, estimated failure rates or confidence bounds. Three retries continue one logical operation. The separate preserved v0.1 suite contains 18 legacy tests; it is not an additional v0.2 case population.
What the correction changed
Three initial checker weaknesses allowed apparent qualification despite the wrong denial cause or invalid step dependencies. The counterexamples included a valid revoked request denied for scope expansion; child admission after grant issuance had failed; and execution after preparation had failed.
The corrected checker separates the observed endpoint from qualification of the intended causal treatment. It checks required delegation/admission dependencies and exact outcomes, including denial for revocation in the relevant fenced schedules. The counterexamples and earlier source remain preserved. These were checker weaknesses, not demonstrated gateway bypasses.
The separate AI-assisted review also records 349 semantic/database assertions and 36 real-IPC assertions. These overlap with other checks and are not independent samples or independent human validation.
Earlier qualification and inspection basis
Version 0.1 remains a narrower trusted transaction/checker fixture with a controller-mediated replacement-worker handoff. Its corrected records contain 18 tests and ten fixtures: five schedules under two arms. Four initial checker false passes and their corrections are preserved. The versions use different case labels and contracts; their counts are not pooled.
The website review inspected the private repository at commit 4ed6e7bc39a02e62beaa53e1b8c05459bcc1b47d, including source, scenario manifest, retained run and replay results, logs, review records and artifact hashes. It did not rerun the qualification or independently repeat the model-assisted review. Supporting artifacts remain private; no public evidence release is implied.
Traceability and preservation
The research record connects selected decisions, substantive AI contributions, sources, artifacts, corrections and open questions. The workbook, CSV tables and notebook are views or copies of one structured record, not independent confirmations of the findings. The notebook’s workbook and both qualification archives match their repository copies byte for byte.
Historical snapshots describe a proposed repository; that wording is preserved because it was true at capture. The later private repository now exists. These editable records do not establish an immutable audit or exhaustive human verification.
06 / Limitations
Where the current evidence stops.
The completed qualification concerns a finite local test. Each broader claim requires its own evidence.
Keep these three claims separate.
- Local measurement qualification
- Completed for the specified v0.2 setup
Scripted workers, one delegation step and protected writes to a local database.
- Autonomous AI-system evaluation
- Conditional future work
No autonomous-agent behavior has been evaluated. A separate, justified study would be required.
- Institutional effectiveness and AGI readiness
- Unestablished
The local results do not demonstrate effective institutional oversight or preparedness for advanced AI.
What was covered, and what remains outside the evidence?
| Boundary | Current local basis | Not established here |
|---|---|---|
| Workers | Scripted parent and child workers follow a planned sequence. | Behavior of autonomous models or agents making their own plans. |
| Delegation | One parent-to-child step and one logical protected change. | Deeper delegation, renewed permissions or partial withdrawal. |
| Protected actions | Writes within one local database on one computer. | Remote effects across services or distributed systems. |
| Enforcement | A separate control component owns protected writes; workers follow the prescribed code paths. | Containment of a malicious worker that tries to bypass the control. |
| Evidence | A read-only observer on the same trusted computer inspects database records. | Authentication of altered evidence or an independent witness to the parent-to-child token exchange. |
| Coverage | Nine fixed event schedules, each run under two permission rules. | Reliability estimates, all possible event orderings, or resilience to crashes and network partitions. |
Originality remains an open question
The design substantially overlaps with prior work. The next experiment still needs a justified replication or a specific unanswered implementation question. Novelty has not been established.
Only the revocation question is active. Evidence trust and oversight at scale remain deferred.
Technical boundaries, related work and broader relevance
Current trust and coverage assumptions
Version 0.2 exercises one root, one parent-to-child edge, one logical effect and a trusted gateway on one host. Processes share an OS user and accessible filesystem. The workers follow prescribed code paths; this does not establish hostile-process confinement or non-bypassable mediation against a malicious principal.
The read-only observer and checker remain same-host components. They do not independently authenticate a coherently altered database, and the database observer does not witness parent-child token delivery. There are no evaluated models, autonomous plans, remote effects, nested descendants, regrant, partial withdrawal, distributed partitions, crash-durability campaign or exhaustive concurrent-interleaving coverage.
Related work and contribution boundary
The design records substantial overlap with Authorization Revocation for Long-Running AI Agents, DelegateGuard, Auditable Agents and Stop Means Stop. These pinned references are carried forward from the design review; this repository inspection is not a new systematic literature review.
The inspected Stop Means Stop artifact can admit an action before cancellation while its effect executes afterward. That contract comparison is not an experimentally demonstrated defect or novelty finding. Admission must not silently substitute for completion. A justified replication or a specific unanswered implementation boundary remains to be selected.
Broader relevance
Autonomous-system control and evaluation quality inform this direction. Institutional resilience is a longer-term concern. Human influence over decisions, as examined by HIT, differs from AI persuasion and manipulation of people. Capability elicitation and post-training are not current activities. These connections do not create additional active studies.
07 / Solutions research
Testing practical controls.
The aim is to help researchers and businesses examine a specific control claim and decide what evidence supports it. The revocation study supplies an initial measurement foundation.
Potential contributions from one investigation
One control question. Three useful outputs.
A requirement to test
After the control records withdrawal, the workflow must not complete a new protected action using the withdrawn authority.
Control evaluation
A matched control comparison
Compare the same protected action under matched conditions and record failures, successful control behavior and unresolved cases.
Intended use Decide whether a control needs adjustment or further testing.
Current basis Local measurement instrument qualified; externally grounded workflow not yet selected.
Inspect the current methodsExplicit control arguments
A map of claims and evidence
Make a control claim explicit, show its assumptions and supporting tests, and keep unresolved conditions visible.
Intended use Scrutinize whether evidence supports a specific control claim.
Status Proposed synthesis; transfer from TAE, HIT and GDI requires justification.
See the related research foundationsReusable evaluation materials
Versioned tests and correction records
Retain test definitions, expected outcomes, failure examples and checker corrections so others can inspect or reproduce checks if the materials are released.
Intended use Compare implementations against the same defined test.
Availability Existing private qualification materials; public release undecided. CEC and GDI provide related representation and traceability practices.
See a recorded qualification example
From research to engineering practice
Mark Julius Banasihan brings more than 15 years of engineering, software quality and technical leadership to the study of practical human control. His approach connects research questions with testable requirements, evaluation methods and candidate operational controls, while preserving the assumptions and evidence needed to judge each claim.
An approach to translation
Research question
Define the control problem in a documented workflow.
Testable requirement
Specify the protected action, authority boundary and observable failure.
Evaluation method
Use matched cases, observed outcomes and explicit qualification criteria.
Candidate operational control
Specify an enforcement design, its assumptions and failure modes.
Operational verification
Define integration tests, monitoring, failure handling and accountable ownership for the selected operating context.
Potential collaborators could contribute a documented workflow or help review a defined control claim. The next phase still begins with selecting one externally grounded workflow and stating what testing it would add.
08 / Program sequence
One active question. Two deferred questions.
- 1 · Active: revocationDoes withdrawal prevent protected actions? Current one-edge model-free qualification completed.
- 2 · Deferred: evidence trustCan reviewers trust the control evidence? No separate active investigation.
- 3 · Deferred: oversight at scaleWhen does oversight become insufficient? Requires a separately scoped study.
09 / Research foundations
Earlier work informs the next test.
TAE, HIT, CEC and GDI supply related assessment questions and evidence practices. Their combination and transfer require explicit justification; this agenda does not reopen their completed or maintenance phases.
- TAE
- Questions about the conditions for practical human control. Its defined methods phase is complete; independent validation and transfer remain unresolved.
- HIT
- Documentary assessment of human judgment and influence. In maintenance; the preserved agreement exercise does not establish general reliability.
- CEC
- Evidence representation, source lineage and missingness. Development materials and synthetic demonstrations do not constitute an independently validated empirical corpus.
- GDI
- Inspectable decision records linking evidence, authority and obligations. Implementation checks do not establish institutional effectiveness.
Reusable action-binding and configuration checks retain their original contracts. The approval-export inspection was static; its restart test has not run. Those materials are not an AGI dataset or observations from this revocation study.
10 / Future objectives and intended impact
Future research objectives
Current stopping point: the research handoff records completion of the controlled measurement qualification and preservation of the reviewed materials. The broader revocation study remains in development; findings about autonomous AI agents and AGI readiness remain unestablished.
When work resumes, the first task is to select one externally grounded delegated workflow and define what testing it would teach us. The objectives below are sequential gates for that next phase.
Select an externally grounded workflow and research question
Choose one documented delegated workflow grounded in an external implementation or practical use case. State what testing it could teach us beyond the controlled examples and existing research, and which decision the result would inform. Justify a replication or identify a specific unanswered control question.
Select a matching implementation
Define when withdrawal takes effect and when the protected action is actually completed. Accepting a request and completing its change are separate events. Match the comparison conditions and decide whether the control boundary requires additional isolation.
Conduct one bounded evaluation when the gates are satisfied
Proceed only with a justified question, matching implementation, reproducible instrument, observable effects and matched comparisons. Freeze the protocol, failure accounting and stopping conditions before execution. Any model-based experiment also requires separate justification and authorization.
Revocation remains the sole research focus; a next-phase experiment has not been selected. Evidence trust and oversight at scale remain deferred. Progress through these gates does not establish novelty or readiness for deployment.
What would change or stop the work
An unmatched admission-versus-commit boundary requires redesign. Incomplete observation prevents a clean result. A reproducible effect violation first challenges implementation assumptions. A structurally uninformative adaptive comparison should not proceed merely to produce model results. A failed novelty gate can justify a useful conformance replication or a stop decision.
Intended use of the research
The intended outputs are inspectable test contracts, reproducibility materials, correction records and bounded findings that help researchers and practitioners decide which control claims deserve reliance and which need further evidence. Institutional benefit and broader effectiveness remain to be evaluated.
Review basis: the supplied design and private repository snapshot, including both qualification archives, v0.2 source, retained results and correction history, and traceability records. This account is based on source and retained-record inspection; the qualification was not rerun during website preparation. No private archive, workbook or notebook is served by this page.