Does an Agent's Approval Record Prove What Executed? Three Protocols, Three Answers

Agent protocols increasingly carry a record of an approval: a statement that some party authorized an action before it ran. A preprint I published in September asks a narrow question of three such protocols — does the record establish that what executed is what was approved? — and finds that they establish different subsets of the answer.

The paper is From Approval to Execution: Assurance Boundaries in Three Agent Protocols (DOI 10.5281/zenodo.22847474, concept DOI, always resolves to the latest version). Not peer-reviewed. No claim of independent validation, certification, adoption, or production effectiveness.

Four properties, not one

The paper extends a four-property receipt decomposition from earlier work (Claim-Level Negative Testing for Agent-Governance Evidence, DOI 10.5281/zenodo.21418702) into four dimensions suited to cross-protocol comparison:

• Content commitment — does the record cryptographically bind to the specific action that was proposed?
• Authenticated approval — is the approver's identity and signature verifiable, not merely asserted?
• Enforcement at execution — does anything on the execution path actually check the approval before the action runs, or can the action proceed regardless?
• Evidence of execution — is there a verifiable record that what ran matches what was approved, after the fact?

Each property answers a different question. A protocol can satisfy one cleanly and say nothing about another. That's the finding: three independently designed protocols split these four properties three different ways.

What the comparison found

Protocol	What it establishes	What it does not
PACT draft-laxsharma-pact-02	Binds referenced content, commits transitively to the evaluated artifact, carries a signed evaluation claim	States plainly that nothing is enforced against its own Facilitator
CognOS LUMEN v0.1 Decision Passport	Commits correctly to the recorded tool and arguments	The document's hashes do not authenticate its asserted approver
Microsoft Agent Host Protocol	Provides behavioral guarantees inside a trusted-host model	No portable cryptographic evidence established beyond that trusted-host boundary

Put plainly: a protocol that binds the content can still leave enforcement unaddressed. A protocol that commits correctly to the action can still leave the approver's identity unauthenticated. A protocol can give you strong guarantees inside its own trust model and none outside it. None of the three is "the one that does approval binding right," because the four properties don't travel together by default — a protocol author has to deliberately close each one.

A positive control, not just a comparison

The paper ships with a protocol-neutral conformance corpus (ABV, the Approval Binding Vectors test suite) that includes positive controls: a deliberately weak checker, built to look reasonable, scores eleven of eleven against the negative vectors while providing no real binding at all. That control exists so the comparison itself is falsifiable — if a weak checker can't be made to fail the corpus, the corpus isn't testing anything.

Why this matters beyond the three protocols named

The paper also names concurrent and later work studying the same binding problem from different angles — consent integrity for single-agent approval dialogs, security-context contracts for composable agent controls, hijacking human-in-the-loop approval, reconstruction-stable authorization, and transitive effects beyond the approved invocation. Seven related or concurrent papers are cited and checked against the same four-dimension frame. That volume of simultaneous, independent attention is itself a signal: approval binding is becoming a recognized open problem, not a niche concern.

For anyone evaluating an agent protocol that advertises "approval" or "human-in-the-loop" as a feature, the four-dimension frame is a direct checklist: does it commit to the content, authenticate the approver, enforce at execution, and produce evidence afterward? A vendor claiming "approved" without being able to answer all four is making a narrower claim than it sounds like.

---

Views are my own. Not peer-reviewed.

Citation: Saleme, M. K. "From Approval to Execution: Assurance Boundaries in Three Agent Protocols." Zenodo, 2026. doi.org/10.5281/zenodo.22847474 (concept DOI).