AGTBRIEF
A new paper calls 'stale authorization' a core failure mode for AI agents on shared resources, and proposes Provenact, a runtime architecture that keeps policy consistent with live state.
A budget was approved. The seat was available. The risk signal was clear. By the time the agent ran the action, the budget was depleted, the seat was gone, the signal had flipped. The effect still cleared.
That mismatch, a "yes" correct at the moment of asking but no longer matching reality when the action runs, is what a new arXiv preprint, "Stateful Governance for Concurrent Agentic Systems", calls "stale authorization." The paper, from a research group proposing a runtime architecture they name Provenact, treats the failure as a property of how policy and live state interact, not of any individual agent.
When many agents act on the same budgets, inventory, and approval queues, that gap matters. The paper's proposed correctness condition, "policy-state serializability," meaning every committed effect must be explainable as authorized against the policy state immediately before it occurs, is meant to close it.
The authors tested a PostgreSQL-backed prototype in a scripted, LLM-free procurement workflow. Against baselines that pass policy state as ordinary request context, they report that Provenact blocks the stale-authorization cases the baselines miss, preserves delayed approvals while unrelated work proceeds, and keeps most policy changes in policy text rather than trusted provider code.
What remains open: whether policy-state serializability is the right condition in the first place, and whether results from a scripted procurement scenario hold up in the messier agent deployments the paper gestures at.