Internet-Draft draft-das-agentic-execution-finality-01.txt is now available.
Title: Tool Selection Is Not Execution: Finality for Agentic Tool Dispatch
Author: Sangam Das
Name: draft-das-agentic-execution-finality-01.txt
Pages: 22
Dates: 2026-08-26
Abstract:
An agentic model can emit a tool call that today's runtimes treat as
something to execute. Allowlists, OAuth tokens, MCP server auth,
sandboxes, output filters, and human approval decide whether an agent
may reach a tool. They do not decide whether this generated call,
with this argument digest, from this instruction chain, at this
delegation depth, may take effect now.
That gap is the incident surface. Prompt-injected content, poisoned
retrieval, a malicious tool response, or a delegated sub-agent can
produce a call that looks like ordinary tool use. If the dispatcher
executes whatever the model selected, policy that lived upstream
becomes advisory.
This document specifies a dispatch-time gate. The model may compute
a call. The call remains a Candidate Act. A Protected Enforcement
Domain binds agent, tool, arguments, purpose, destination,
provenance, and policy epochs, then issues scoped non-bearer
authority. A Tool-Dispatch Finality Sink verifies that authority
against the actual invocation immediately before the tool runs, then
consumes it. The same gate applies to support, coding, payments,
clinical, SOC, browser-use, and multi-agent MCP deployments. Tool
selection is not execution authority.
The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-das-agentic-execution-finality/
There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-das-agentic-execution-finality-01.html
A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-das-agentic-execution-finality-01
Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts
_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.