An Approval Can Be Spent Before an Effect Is Delivered
What does a refused retry actually establish?
Single-use approval consumption can restrict reuse without answering whether an external action finished. In the current internal experiment, every concurrent race admitted exactly one consumer. In a separate controlled case, the probe deliberately omitted the effect after committing consumption; a later retry was still refused. Local token state and external delivery are different facts.
The subject is the database consumption mechanism at a pinned ASU revision. The bounded conclusion is that approval consumption and effect delivery require separate evidence. We did not cause a real gateway crash or establish that a deployed system lost a user action. Inspected source revision
What the isolated probe measured
This was a source-derived isolated function probe: the pinned consumption and transaction methods were extracted and executed against SQLite. The audit sink was replaced with an in-memory recorder and the clock was injected. Results consequently do not cover failures in the original audit system or real clock skew.
Twenty races each used 16 independent database connections: 320 concurrent calls in total. Exactly one consumer succeeded in each race, giving 20 successes and 300 refusals. These are internal measurements under the tested thread-and-connection conditions, not multiprocess stress results or a universal concurrency proof.
| Control condition | Consumption outcome |
|---|---|
| Approved, current time before expiry | Accepted |
| Current time exactly at expiry | Refused |
| Expired | Refused |
| Pending | Refused |
| Denied | Refused |
| Missing record | Refused |
Source: the current internal source-derived probe dated 2026-10-31, using methods from the pinned database implementation. All six controls matched expectations. No full gateway, signature verification or real external resource was exercised.
The controlled interruption must also be named precisely: first consumption succeeded, its transaction committed, the harness intentionally omitted the external effect, and a second consumption was refused. The absent effect was constructed by the test; it was not observed in a real incident. This shows that the consumption method itself supplies no external-delivery evidence, not that the full product lacks every possible recovery mechanism.
The boundary between consuming and executing
Static inspection shows a conditional update inside an immediate write transaction: only an approved, unexpired row can become consumed. The gateway checks session, user, stored and resubmitted descriptor digests, re-resolves raw arguments and may reverify receipts. It consumes approval before entering the actual effect-execution path. Gateway implementation
The database transaction protects competing updates to that approval record. It does not automatically include durable external effects within the same local transaction. Conflating these layers promotes at-most-once consumption into exactly-once delivery. Static ordering and the isolated probe support separating the boundaries; they provide no measured probability of loss after real crashes.
Microsoft’s agent-governance-toolkit ADR 0030 binds approval to an action digest and policy/chain versions, requires execution-time revalidation, and places consumption at the transaction or idempotency boundary that begins execution. An individual allow vote is not an execution token. This design requirement helps frame the boundary but does not establish compliance by every integration or rank two systems under matched security tests. Action-bound approval protocol
Recovery needs additional effect evidence
An externally effective execution system could retain approval resolution, committed consumption, attempted effect and effect receipt separately. This is our architectural interpretation of the experiment, not a validated recovery implementation. An interruption after consumption but before a receipt requires resource-specific evidence for confirming the outcome or a defined compensation boundary.
A consumed flag alone cannot establish delivery. Nor should automatic replay be recommended without verifying the resource’s idempotency boundary. A resource may offer durable idempotency keys, queries or reconciliation that fill gaps outside this probe. Their omission here is not evidence of their universal absence.
Consume-before-effect also has a clear purpose: preventing repeated use of an approval. Our result does not establish that the ordering is wrong or that reversing it is generally safer. A particular integration needs to explain both anti-replay and recoverable delivery rather than substitute success at one objective for evidence about the other.
Evidence and sources
Internal experimental evidence comes from the current isolated function probe, not an independent third-party test. Static source observation describes a pinned implementation; a public design document supplies requirements; paper attack results remain author reports. These roles are distinct.
Implementation material is the maintainers’ pinned source, revision 056742b00a9d116a57525c75704820bb87756e84. The comparison document is Microsoft’s ADR 0030. The paper is the authors’ preprint, version 1; our probe date is 2026-10-31. Paper experiment revisions differ from the inspected commit, and two experiments disclose dirty working trees. They cannot be treated as identical executed versions.
The authors report forged-narration attack success falling from 0.54 to 0.03 across 609 task pairs under an exact-compare oracle. We did not reproduce that result. There are no human-subject data; the oracle is an upper-bound condition, and host confirmation matches the system under measured conditions except grant-related differences. This does not establish that a second device improves real human decisions. Paper sections 7–8
Formal materials explicitly assume trusted-field decisions, closed enrollment and an honest rendering origin, and distinguish key signatures from evidence of human consent. Parts of the model exclude expiry, session binding, amount aggregation, free-text grants and flood control. Historical vulnerability comments in red-team tests are not current failing-test results. Formal materials We ran neither those proofs nor attack tests. Publication, citation and successful implementation do not automatically establish general validity.
The cover is editorial artwork based on the consumption/delivery boundary. Its empty result location represents missing evidence, not inevitable effect loss in the real system.
The delivery responsibility still untested
We did not test real gateway crashes, audit rollback, database corruption, multiprocess scheduling or external resource idempotency. Signatures, trusted rendering and cross-language canonicalization require separate validation. Paper cells that are static or derived, placeholder stimuli and unaudited proprietary systems also limit cross-system extrapolation.
The unresolved question is concrete: when approval is consumed but the effect receipt is missing, what recoverable resource evidence can this integration produce? Until that evidence is available, consumption success can be reported accurately while delivery remains a separate fact to determine.