Signed agent requirements can be compromised before authorization is sealed

Signed agent requirement or policy manifests protect the bytes after signature, but a hostile input that changes what an operator selects before signing can place an unauthorized instruction inside a formally valid signed artifact.

The controlled study emphasizes an admission and review boundary before cryptographic sealing. Signing itself cannot establish that the authorized human intended the content.

A digital signature can prove that a requirements artifact has not changed since sealing while still proving nothing about whether the artifact captured the original human request. The study examines a lower-trust pre-signing stage where attacker-influenced content changes requirement extraction or a delegation handoff. Once the contaminated content is signed, downstream agents can obey a cryptographically valid but unauthorized task specification. The attack must therefore be prevented before authorization is sealed, using independently trusted requirements and explicit human admission checks for effects and recipients. This is a controlled demonstration of semantic authorization failure, not evidence of a broken signature primitive or an observed deployed attack.

The signature is doing its narrow cryptographic job: authenticating the bytes that were sealed. The breach happens earlier if lower-trust material is allowed to redefine which requirements a person supposedly authorized. Once that altered specification is signed, later signature verification only confirms the wrong decision was faithfully transmitted. This is related to the evidence-gated reviewer study but not identical; one concerns hostile contamination before authorization, while the other concerns a reviewer that can override a valid proposal without sufficient counterevidence.