AI 中文总结
研究长期存在的人工智能智能体部署后演化引发的授权问题，提出状态边界模型阐述授权连续性，通过固定过渡包络和效果上限，区分请求与实现效果，证明突变不会超上限，还映射了六种突变类别的授权后果。
AI 中文摘要
长期存在的人工智能智能体在部署后会通过保留经验、获取技能和工具、修改工作流程、委托工作以及跨越任务阶段来不断演化。这提高了适应性，但引发了一个独特的授权问题。具备工具的智能体可将模型错误和提示注入转化为相应的外部行动；当在实时授权下发生演化时，行使该权限的主体或其行动的上下文可能不再与用户评估的一致。演化会改变旧授权下可达成的效果以及任务所需的权限，权限可能上升、下降或变得不可比。现有工具策略限制行动，但未确定授权在这种变化下何时仍然有效。我们阐述了授权连续性：现有授权何时仍然有效，当前权限可能如何变化，以及什么界限绝不能移动？我们的状态边界模型在授权时确定一个过渡包络和一个不变的效果上限。包络决定授权在突变后是否仍然有效；在上限以下，权限可自由收缩，仅在特定证据条件下扩展。我们区分请求的效果和实现的效果，并证明在完全调解、合理的效果抽象、衰减委托和监控完整性的情况下，突变不会将受保护的效果放大到用户设定的上限之外。智能体产生的证据可在上限以下分配权限，但不能提高权限。最后，我们将六种突变类别映射到它们的授权结果。
英文摘要
Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. This improves adaptation but creates a distinct authorization problem. Tool-enabled agents can turn model errors and prompt injections into consequential external actions; when evolution occurs under a live grant, the subject exercising that authority or the context in which it acts may no longer match what the user evaluated. Evolution can change both the effects reachable under an old grant and the authority required by the task, which may rise, fall, or become incomparable. Existing tool policies constrain actions but do not determine when a grant survives this change. We formulate authorization continuity: when does an existing grant remain valid, how may active authority change, and what boundary must never move? Our state-bound model fixes a transition envelope and an immutable effect ceiling at grant time. The envelope determines whether the grant survives a mutation; below the ceiling, authority may contract freely and expand only under specified evidence conditions. We distinguish requested from realized effects and prove that, under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling. Agent-produced evidence may allocate authority below the ceiling but cannot raise it. Finally, we map six mutation classes to their authorization consequences.
