Zero-Knowledge Proofs Could Let AI Agents Prove They Are Allowed to Act

Autonomous AI agents are quietly becoming the new operating layer of the internet. They book meetings, query databases, invoke APIs, chain tools together into multi-step plans, and increasingly do all of this with little or no human supervision. That shift has exposed a security hole that most people have never thought about but that cryptographers and security engineers now consider urgent: when an AI agent asks to do something, the systems it contacts can usually verify who the agent is, but they have no cryptographic way of verifying that this particular request, made in this particular context, is actually allowed by policy. A new study published in Frontiers in Computer Science argues that this missing guarantee is not just an engineering gap but a formally definable, provable security property, and it backs the claim with a working zero-knowledge prototype.

The research, conducted by Mar Llambí-Morillas of Universidad Tecnológica Atlántico-Mediterráneo in Málaga and Daniel Fernández-Fernández of Universidad de Santiago de Compostela, starts from a deceptively simple observation. Authentication and delegation are not authorization. A system can know exactly which agent is knocking on the door; it can even hold a valid capability token delegated by a human user; and still have no idea whether the specific action that agent is about to take is permitted under the policy that applies right now, in this execution context, against this resource. The authors express this as a logical non-implication: knowing the agent and knowing its delegated authority does not entail that a concrete request is authorized. Delegation may grant power over a broad class of operations, but the permissibility of any single request can still hinge on the target resource, the runtime context, the version of the policy being applied, and the moment in time.

Why does this matter now, when it did not matter as much five years ago? Because AI agents have moved from controlled pipelines, where their behavior was fixed at deployment, to open agentic architectures, where they autonomously select tools, construct plans, and act on external resources in ways nobody anticipated when the system was built. In that setting, permissibility cannot be settled once at login. It has to be evaluated at request time, against policies that depend on dynamic runtime attributes. Institutional analyses have begun to sound the alarm. ISACA has characterized the situation as a looming authorization crisis, a systematic failure of existing identity and access management frameworks, including OAuth 2.0, OpenID Connect, and SAML, when applied to agents that violate their foundational assumptions of deterministic behavior and a single authenticated principal. The OpenID Foundation has similarly concluded that adapting existing protocols is insufficient and has proposed new identity management primitives for agentic contexts. The new study complements those analyses by giving the gap a precise formal shape: what is missing is a security property, not merely an architecture.

The authors call that property Cryptographically Verifiable Agent Authorization, or CVA. Their central hypothesis is falsifiable, in the scientific sense: authorization decisions for autonomous AI agents can be represented as cryptographic relations that jointly bind four things, the agent principal, the concrete authorization request, the execution context, and the satisfaction of an applicable policy, while selectively keeping private authorization attributes confidential. In the formal model, a prover, the agent, produces a cryptographic proof showing that a public authorization statement is supported by private witness data satisfying the authorization relation, without revealing that witness. The public statement includes the agent’s public identifier, a commitment to the requested action, a commitment to the context, a policy identifier, and freshness parameters such as a nonce and timestamp. The private witness includes the agent’s secret, its private authorization attributes, and the preimages that open the public commitments. A verifier, an authorization gateway, checks the proof and learns only that the relation holds, nothing more.

The technical machinery rests on zero-knowledge proofs, a class of cryptographic protocols in which a prover demonstrates the truth of a statement without revealing any information beyond the statement’s validity. The field has matured dramatically since the foundational interactive protocols of the 1980s. Groth16 established efficient pairing-based non-interactive arguments with remarkably small proofs; STARKs removed trusted-setup requirements at the cost of larger proofs; Bulletproofs provided efficient range proofs without trusted setup. Applied work has already demonstrated the viability of these constructions in distributed authentication contexts. What the new study insists on is precision about the object being proven. The relevant statement is not that an agent owns a credential, corresponds to a registered identity, or executes approved code. It is whether a specific authorization request is supported by private attributes and contextual information that satisfy an applicable policy.

To make the abstraction concrete, the authors define a compact set of candidate security properties, each aimed at a distinct class of attack. Authorization soundness blocks proof forgery: an adversary should not be able to produce an accepted proof for a statement for which no valid witness exists. Principal binding blocks cross-principal transfer: a proof generated for one agent’s identifier must not verify under a different agent’s identifier. Authorization-request binding blocks cross-request transfer: a proof bound to one request must not authorize a different one. Policy binding blocks cross-policy transfer: a proof generated under one policy version must not serve as evidence under another. Replay resistance blocks proof reuse, enforced through nonces and timestamps bound into the public statement and checked against gateway-held state. The authors also formalize context binding, which prevents substitution of the context commitment at authorization time, and attribute privacy, inherited directly from the zero-knowledge property of the underlying proof system. Informal reduction sketches connect these properties to standard assumptions: knowledge-soundness of Groth16, collision resistance of the hash functions, and the binding property of the identity commitment, which in the general model follows the Pedersen construction and reduces to the hardness of the discrete logarithm problem.

The proof of concept is executable, not just theoretical. It was publicly demonstrated at RootedCON Madrid, an independent security conference, before the formalization appeared. The implementation uses the Groth16 zk-SNARK construction over the bn128 curve, with circuits written in Circom 2.x and proof generation via snarkjs, choices motivated by Groth16’s minimal proof size and constant verification time, both favorable for gateway-side enforcement. The gateway is a FastAPI service performing stateless proof verification and stateful replay control. The prototype instantiates a restricted version of the full CVA relation: the prover demonstrates knowledge of the private secret corresponding to the public agent identifier, using a randomized two-input Poseidon hash for circuit efficiency; the proof is bound to a committed plan, the requested action sequence, via SHA-256; and the private authorization attributes and committed plan must satisfy a policy predicate encoded as arithmetic constraints in the circuit. Freshness and replay protection are deliberately enforced outside the circuit, because proof verification is stateless while replay resistance requires mutable enforcement state.

The performance numbers suggest the approach is operationally plausible. The circuit contains 531 constraints. Witness generation takes about 61.9 milliseconds, proof generation about 351.9 milliseconds, and verification about 309.4 milliseconds, measured on an AMD Ryzen 7 7700 with a WASM prover backend, with all timings including Node.js process startup overhead. The proof is just 805 bytes. The authors are careful about what these figures do and do not show: they characterize a single circuit configuration, not empirical scaling, and Groth16’s constant-time verification with respect to circuit size is an established property of the proof system rather than something the benchmark set out to validate. The authors also map, conservatively, which candidate properties the prototype actually implements. Principal binding and attribute privacy are implemented. Request binding is implemented at the plan level, partially relative to the full model. Authorization soundness is partial, resting on circuit constraints and SNARK soundness assumptions. Policy binding is partial, with no explicit policy identifier as a public input in the current prototype. Replay resistance is implemented externally. Context binding and runtime execution binding remain open.

That last open item is the study’s most consequential finding, and the one the authors identify as a central open problem in the design of secure agentic systems. A valid zero-knowledge proof establishes that a committed request satisfies the authorization relation. It does not establish that the runtime subsequently executes the same request. The gap is structural, not incidental: a ZK circuit is evaluated at proof generation time over a committed representation of the intended request, and it has no access to runtime state at execution time. It cannot constrain what the agent does with the authorization it receives. The authors trace this gap to the classical confused-deputy problem and to time-of-check-to-time-of-use race conditions, which have recently been shown to manifest concretely in LLM-enabled agents. Closing it requires a trust anchor that operates at execution time rather than at proof generation time, such as remote attestation, a trusted execution environment, or verifiable execution receipts. The same structural reasoning extends to multi-agent delegation chains, where an agent that delegates a subtask to another agent must prove not only that its local request satisfies policy but that the delegation preserves, constrains, or attenuates the authorization scope granted upstream, a condition the authors deliberately leave unformalized as future work.

The authors are explicit about the limits of what they have built. The formal model is preliminary, and complete security reductions for the candidate properties remain future work. The prototype has not been subjected to an independent cryptographic circuit audit. Groth16 requires a trusted setup ceremony, and the system is not post-quantum secure. The encoded policy language is constrained to static arithmetic circuits, so dynamic or procedural policies cannot be represented without circuit recompilation. No comparative benchmark across proof systems has been conducted, and no multi-agent delegation chain has been evaluated. The authorization gateway is partially trusted; its compromise would void freshness enforcement, though principal, request, and policy binding would survive, since those guarantees depend on SNARK verification over the public statement rather than gateway-held state. What the study delivers instead is a falsifiable research agenda, organized around three questions: which dimensions must be cryptographically bound to prevent proof transfer across principals, requests, contexts, policies, and execution domains; which classes of agent authorization policies can be efficiently represented as arithmetic ZK relations under practical circuit complexity constraints; and what overhead request-bound ZKP authorization introduces under different proof systems and agent workload profiles. The broader reorientation the authors propose is striking: authorization should no longer be studied as a configuration problem solved once at deployment, but as a per-request cryptographic property that must be established, verified, and composed across agent interactions. As autonomous agents become infrastructure, invoking tools, delegating tasks, and acting on protected resources at scale, the gap between authenticated identity and verified authorization is likely to widen. Closing it, the authors argue, requires developing authorization evidence as a first-class security primitive alongside identity, delegation, and runtime execution evidence.

Subject of Research: Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept

Article Title: Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept

Article References: Llambí-Morillas, M., & Fernández-Fernández, D. (2026). Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept. Frontiers in Computer Science, 8, Article 1966725. https://doi.org/10.3389/fcomp.2026.1966725

Image Credits: AI Generated

DOI: 10.3389/fcomp.2026.1966725

Keywords: Cryptographically, verifiable, authorization, autonomous, agents, falsifiable, hypothesis, proof, concept, scientific research