智能体金融中的权限-推理分离：一线控制、区块链执行与可重放保障
Authority-Inference Separation in Agentic Finance: First-Line Control, Blockchain Enforcement, and Replayable Assurance
浏览论文内容
中文总结 AI 辅助
本研究提出智能体金融的权限-推理分离（AIS）架构，经多场景测试，AIS可抵御多数授权攻击、重放等风险，与区块链互补保障金融操作安全。
中文摘要 AI 辅助
AI智能体可选择工具、交易对手及交易参数，但推理本身不应赋予执行金融操作的权限。本研究开发并评估了以意图为核心的受限智能体金融架构——权限-推理分离（AIS）。AIS将金融操作意图作为控制对象：机器生成的提案仅在独立确定性控制平面验证注册智能体身份、可问责所有权、授权与风险偏好谱系、策略版本、状态、审批及精确经济语义后，方可获得临时执行权限。区块链随后可执行已授予权限的操作表示并记录可移植结算证据，而机构合法性、服务交付、会计分类及人类问责则保持为链下义务。评估结合了四领域实例化、国际清算银行（BIS）与MAS官方案例、48个装置的可执行原型及公共账本可观测性测试：在36次合成授权攻击中，直接智能体基准接受了全部36次攻击效果，提示策略基准接受了20次，AIS则全部未接受；三者均接受了8/8可容许装置。AIS还拒绝了全部4次代币重放攻击、8/8接收方或通道替换，在4/4服务交付失败时弃权（不执行），并填充了全部13个定义的证据字段。对与公共x402 facilitator地址关联的1700笔近期Base交易的测试显示，公共账本可证明结算及选定授权参数，但无法确立机构授权、法律问责、服务交付或会计处理。因此AIS与区块链互补：AIS决定特定意图是否可执行，而区块链可使已授予权限受限、可执行且可独立观测。
英文摘要
AI agents can select tools, counterparties, and transaction parameters, yet inference should not itself confer authority to execute a financial action. This study develops and evaluates Authority-Inference Separation (AIS), an intent-centered architecture for bounded agentic finance. AIS treats a financial action intent as the control object: a machine-generated proposal can receive temporary executable authority only after an independent deterministic control plane validates registered agent identity, accountable ownership, mandate and risk-appetite lineage, policy version, state, approvals, and exact economic semantics. Blockchain can then enforce the operational representation of granted authority and record portable settlement evidence, while institutional legitimacy, service delivery, accounting classification, and human accountability remain off-chain obligations. Evaluation combines four-domain instantiation, official BIS and MAS cases, a 48-fixture executable prototype, and a public-ledger observability test. Across 36 synthetic authorization attacks, a direct-agent baseline accepted 36 attack effects, a prompt-policy baseline accepted 20, and AIS accepted none; all three accepted 8/8 admissible fixtures. AIS also rejected 4/4 token replays and 8/8 recipient or rail substitutions, withheld completion in 4/4 service-delivery failures, and populated all 13 defined evidence fields. A test of 1,700 recent Base transactions associated with public x402 facilitator addresses shows that public ledgers can evidence settlement and selected authorization parameters but cannot establish institutional mandate, legal accountability, service delivery, or accounting treatment. AIS and blockchain are therefore complementary: AIS decides whether a specific intent may act, while blockchain can make granted authority bounded, executable, and independently observable.
发表机构
- UCL Institute of Finance & Technology, University College London（伦敦大学学院金融与技术研究所）
机构由 AI 辅助整理，请以论文原文为准。
