Matoi separated reusable agent proof evidence from live permission to act

Matoi tests whether an agent runtime can reduce repeat verification work without caching yesterday's authority as if it were today's. Its reusable object is a previously checked fact tied to its validity dependencies, not an unconditional authorization or signed instruction to execute a transaction.

Current recipient allowlists, permissions, revocation, remote errors and uncertain commit outcomes remain live checks. The evaluation includes synthetic financial flows and 1,440 matched benchmark cells. Reported full-lifecycle reductions under equivalent compact representations were 3.49% in JavaScript and 1.79% in Python; some alternative presentation comparisons combine multiple optimizations and cannot be credited to reuse alone.

Proof caching helps only when the invariant is truly stable and the runtime still enforces fresh authorization at the external-effect boundary. Before adopting another verification layer, compare it to simpler attribute-based access control using the same workload and failure tests.

Matoi draws a narrow boundary between a previously checked stable predicate and a current grant to perform an action. A cache entry can retain a version-bound proof that a certain artifact satisfied a stable condition, but it cannot freeze a bank's recipient policy, revocation state, spending limit or an external service's uncertain result. The authors' matched compact-input experiment isolates the reuse benefit at 3.49% in JavaScript and 1.79% in Python; larger cited savings change the representation as well. The prototype banking actions were scripted, and the evaluation does not prove remote transfer atomicity or an advantage over straightforward allowlist enforcement.

The research separates a reusable previously proven predicate from current power to act. A cached fact can be safe to reuse when its dependencies still match, but current revocation, recipient constraints, balances and uncertain external commits cannot be inferred from that cache. The related Sepolia incident shows the complementary negative case: possession of a technically usable signing key still did not authorize the task's wallet spend. Both require current principal-action-resource checks, even though their evidence settings differ.