An agent can keep permission after its task stops needing it

A permission check at the beginning of a task answers whether a capability may be issued. It does not answer whether that capability should still be usable ten steps later, whether the content prompting an action came from an authorized origin, or whether a timeout means a tool operation was safely rolled back.

The CreepScope study measures excess authority after the last authorized use. Its synthetic step-lease oracle removed post-use exposure that remained under persistent grants. The critical qualification is that a deployed system cannot always know the final justified use in advance.

The Android WebView investigation describes how an agent can observe web content through a trusted app without observing the actual document origin. Provenance and application branding are different properties; inaccessible origins cannot be recovered through confidence in the language model.

The RetryBench experiments demonstrate model-dependent willingness to retry ambiguous tool calls using changed idempotency keys. A timeout is not evidence of failure to commit. The target service has to preserve idempotency and authorize duplicate-safe recovery independently of a model suggestion.

These studies evaluate defined harnesses and synthetic tasks. Their numbers are not production incident rates. Together they suggest a concrete test for an agent runtime: record the origin of actionable inputs, revoke authority after the authorized effect window, and enforce idempotency where real side effects commit.

Authority has at least three clocks: the lifetime of a grant, the freshness of the evidence justifying the next action, and the commit state of the external target. CreepScope tests stale grants, WebView origin research tests misidentified evidence origin, and RetryBench tests incorrect assumptions after ambiguous completion. A lease, a provenance label and an idempotency key solve different parts of the problem; none makes the other two checks unnecessary.

A grant can be authentic yet stale. A tool instruction can be recent yet sourced from a webpage embedded inside a trusted application. A retry can carry a valid-looking new key even when the previous payment request already committed. These are different failure conditions and require different evidence.

An audit log that records an agent's intention without the service's commit result is insufficient to answer the third question. Revocation alone cannot reconstruct source provenance, and provenance alone cannot ensure a grant has expired. These papers supply distinct test designs, not an observed common production incident.