AI 中文总结
针对联邦AI智能体工作流的权限一致性问题，提出VERA可验证边撤销机制，解决树级联过度撤销与部署者级联欠撤销问题，在LangGraph等框架中验证了其有效性与模式可移植性。
AI 中文摘要
现代智能体框架将规划器、工具智能体、远程服务及共享专家组合成运行时委托图，但其撤销API仍类似令牌或子树失效。当一项委托被撤回时，运行时需明确哪些智能体丧失权限，而独立授权的智能体仍可正常工作。我们研究这一权限一致性问题并提出VERA（智能体可验证边撤销机制，Verifiable Edge Revocation for Agents），它是由智能体运行时适配器作为签名证据发出的可验证撤销合约与API。在析取权限下，撤销边e会恰好使T_intent(e,G)=reach(G)\reach(G\{e})失效，即每条授权根路径都使用过e的智能体。作为合约，这一目标暴露两类运行时故障：树级联撤销会过度撤销共享智能体，而部署者级联的级联会欠撤销跨域后代。在LangGraph框架中，重复20次的replt单元产生500个编译框架轨迹和2000个有效签名委托决策；25个单元中有13个存在运行时多解析问题，8个存在跨部署者问题。500/500个目标证明保留了树级联撤销会影响的全部320个备选父共享智能体案例，并拒绝未授权签名者与遗漏攻击。对19个基准的基线重放显示，持有者/节点与树式目标无法表达此行为。我们进一步在A2A、AutoGen和CrewAI构件上验证了模式可移植性：9个轨迹，包括5个可执行的委托事件均通过模式与签名检查。
英文摘要
Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation APIs still resemble token or subtree invalidation. When one delegation is withdrawn, the runtime must know which agents lose authority while independently authorized agents keep working. We study this authority consistency problem and introduce VERA (Verifiable Edge Revocation for Agents), a verifier-checkable revocation contract and API emitted by agent-runtime adapters as signed evidence. Under disjunctive authority, revoking edge e invalidates exactly T_intent(e,G) = reach(G) \ reach(G \ {e}), the agents whose every authorizing root path used e. Used as a contract, this target exposes two runtime failures: tree cascades over-revoke shared agents, while deployer-scoped cascades under-revoke cross-domain descendants. In a LangGraph framework-replt cells repeated 20 times yield 500compiled-framework traces and 2,000 valid signed delegation decisions; 13/25 cells contain runtime multi-parsharing and 8/25 contain cross-deployer shies 500/500 target proofs, preserves all320 alternate-parent shared-agent cases that tree cascade revokes, and rejects unauthorized signers and omission attacks. Baseline replay over 1,9that holder/node and tree-style targetscannot express this behavior. We further validate schema portability on A2A, AutoGen, and CrewAI artifacts: nine traces, including five executable Cregned delegation events that pass schema and signature checks.
