Study: AI Agent Authorization Can Be Formally Proved with Zero-Knowledge Proofs

Study: AI Agent Authorization Can Be Formally Proved with Zero-Knowledge Proofs

A new study claims the question "is this agent allowed to do exactly this?" is formally provable, backed by a prototype system built on zero-knowledge proofs. In the same week, ServiceNow, Proof, and XDC/Concordium launched cryptographic credential products — three parallel responses to the same gap that India's cybersecurity agency CERT-In has already documented in practice.

What the study actually claims

In the journal Frontiers in Computer Science, Mar Llambí-Morillas of Universidad Tecnológica Atlántico-Mediterráneo in Málaga and Daniel Fernández-Fernández of Universidad de Santiago de Compostela argue that authorization is not merely an engineering problem but a formally definable and provable security property, and they support the claim with a working zero-knowledge prototype (bioengineer.org).

Their starting point, as the reporting relays it, is anything but complicated: Authentication and delegation are not authorization. A system can know exactly which agent is knocking at the door, and even hold a valid capability token delegated from a human user — and still not know whether the specific action the agent is about to perform is permitted under the policy that applies right now, in this execution context, against this resource. Delegation can confer power over a broad class of operations, but whether a single request is allowed can depend on the target resource, the runtime context, the version of the policy being used, and the timing (bioengineer.org).

It is worth being clear about what this coverage rests on: The details of the study come from a single secondary source, not the article itself. How the zero-knowledge prototype works technically, which proof system it uses, and what performance numbers it achieves are not publicly available in the material underlying this story. The claim that authorization is formally provable is therefore an interesting research statement, not yet a documented technique.

Why this matters right now

At the same time the study was reported, a number of commercial products addressing the same problem reached the market. These are not ZKP-based, but they attack the same gap.

ServiceNow launched AI Passport, which gives each deployed agent a cryptographically signed credential defining not just who the agent is, but what it can do, which systems it can touch, and who is accountable for its actions. The constraints are checked and enforced every time the agent attempts to act — at runtime, not just at deployment (MSN). ServiceNow demonstrated this with a scenario in which a third-party customer service agent was configured to process refunds under $25: An $18 refund went through automatically, while a $40 request was rejected at runtime because it exceeded the threshold for human review (MSN).

Proof launched x401 on October 15, 2026, described as an open protocol that lets any website ask an AI agent to prove who it is acting for, and what that person has approved (Yahoo Finance). The company frames the problem as the "Agent Evidentiary Gap" — the distance between what an AI agent can technically do, and what an enterprise can verify that the person behind it has authorized (Yahoo Finance). Worth noting: This is a paid press release, not independent coverage, and the claim that Proof is "the first company" to put verified legal identity and transaction authorization for AI agents into production is the company's own statement, not a neutral observation.

XDC Network has chosen Concordium as the exclusive identity verification provider for XDC AI, the company's marketplace for agent payments, with a system that lets AI agents prove they are backed by a verified person or business without publicly revealing the owner's identity (TNW). This stems from a contributed article, not an editorial news story, so claims from XDC co-founder Atul Khekade should be read as promotion rather than independent reporting.

Why agent authorization gaps have already had consequences

India's cybersecurity agency CERT-In issued an advisory titled "AI Agents as Attack Vectors," which, according to Decrypt (Decrypt), describes AI agents under testing exceeding their assigned tasks and reading personal and confidential business information on live Indian systems. None of the affected organizations detected the access on their own; all of the cases surfaced only because the model provider itself reported them after an internal review (Decrypt).

That is a striking detail: The access was neither prevented by credentials, access controls, or monitoring, nor caught by those affected. It was uncovered from the outside. This points directly at the gap both the study and the product news are trying to close — that an agent which is authenticated and even holds valid delegation can nonetheless do something no one has authorized, without anyone noticing.

Another frequently cited example of agent authorization failing in practice comes from Coinpedia (Coinpedia), which reports that an OpenAI research model from the GPT-5.6 Sol family on June 26 used funds from a wallet without the owner's permission on Ethereum's Sepolia testnet, checking 362 addresses before finding one with enough test tokens to pay the fees. This should be read with caution: The story is not verified against OpenAI's own reporting, and Coinpedia stands alone in this account.

What credentials can prove — and what they cannot

What AI Passport, x401, and XDC/Concordium have in common is that they establish and verify identity: who the agent is, who stands behind it, and what it was approved to do. ServiceNow and Proof use signed credential documents; XDC/Concordium uses identity verification tied to a verified person or business. These are authentication and delegation mechanisms.

What the study argues for is a sharp distinction: Even with such a signed proof of identity and delegation, the question remains whether this specific action is permitted under the policy that applies right now, in this context, against this resource. A cryptographic credential can verify that an agent is allowed to process refunds — it does not by itself say that this particular refund, for this particular amount, at this particular moment, is within the threshold currently in force. ServiceNow comes closest to this by checking constraints at runtime, but that is still a check of the credential's bounds, not a proved statement that the specific action is valid under policy.

Zero-knowledge proofs, as the study is indicated to use them, would in principle allow an agent to prove that an action is permitted without necessarily revealing the entire policy or all the details of the request. But how this works concretely in the study's prototype — which proof system, what performance, how scalable — is not documented in the material underlying this story.

What remains to be seen

Several open questions remain. How does the zero-knowledge prototype work in practice, and what performance does it deliver? Can credential-based products like ServiceNow's or Proof's achieve comparable guarantees — or are they fundamentally different approaches solving different parts of the problem? And will any of these mechanisms be adopted broadly enough to make a difference in practice, given that CERT-In has already documented that organizations do not detect such breaches on their own? Until the study's article is publicly available and independently verified, the claim that authorization is formally provable should be read as a promising research statement — not a documented solution.