💻 computer science

Proof-of-Continuity: A Temporal Model for Authority Propagation in Distributed Systems and AI Agents

This paper introduces Proof-of-Continuity, a causal authority propagation model that ensures each execution step in distributed systems and AI agents is strictly linked to its origin and limited to a non-expansive subset of the original authority, thereby preventing the confused deputy problem by guaranteeing that exercised privileges were present in the initial request context.

Original authors: Nicola Gallo

Published 2026-07-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Nicola Gallo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you're running a high-stakes relay race, but instead of a baton, the runners are passing around a magic key that unlocks doors.

In the old way of doing things (called Proof-of-Possession), the rule is simple: "If you are holding the key, you can open the door." It doesn't matter who gave you the key or why you have it. If a runner picks up a key from a lost-and-found box, or grabs a spare key from their own pocket, they are allowed to use it.

The paper argues that this is dangerous. It's like a confused deputy: imagine a user asks a computer program to "save a file." The program, holding its own master key, decides to save that file to a secret government vault because it has the key, even though the user never asked for that and never had the right to open that vault. The program is "confused" because it's using a key it owns, rather than the specific permission the user gave it for this specific task.

The New Idea: Proof-of-Continuity

The author, Nicola Gallo, proposes a new rule called Proof-of-Continuity.

Instead of just checking if you have the key, we now check if your key is connected to the start of the race.

Think of the execution chain (the sequence of steps a computer takes) as a river.

The Source: The race starts at a spring (the origin). The spring releases a specific amount of water (authority/privileges).
The Flow: As the water flows downstream, it can only get smaller or stay the same. It can never magically grow bigger. If the spring released water for "reading a map," the river downstream can only carry "reading a map." It cannot suddenly turn into a flood capable of "demolishing a building."
The Checkpoint: At every bend in the river (every step in the computer's process), we don't just ask, "Do you have a bucket?" We ask, "Is this bucket of water flowing directly from the source, and is it the same water?"

This is the core finding: Authority is not just something you hold; it's a continuous thread connecting back to the beginning. If a step in the process tries to use a privilege that wasn't in the original "bucket" from the source, the river breaks, and the action is blocked.

What This Rules Out

The paper explicitly argues that the old "Proof-of-Possession" model is insufficient for complex, multi-step tasks (like AI agents or distributed services).

It proves that if you only check who holds the key (possession) without checking where that key came from in the chain (lineage), you cannot stop the "confused deputy" problem. The paper uses a mathematical proof to show that a system cannot have three things at once:

Letting a helper hold its own keys and the user's keys.
Making decisions based only on who holds the keys (ignoring the history).
Being safe from the confused deputy.

The paper concludes that to be safe, you must drop the idea of ignoring the history. You have to make the decision "lineage-sensitive." You can't just look at the key; you have to look at the river.

How Sure Are We?

The paper doesn't just suggest this might work; it proves it mathematically.

The author defines a formal model (called the PIC Model) with strict rules.
They provide Theorem 1 and Theorem 6, which are logical proofs showing that if you follow the "Proof-of-Continuity" rules, it is impossible for a confused deputy to happen. It's not a bug that might be fixed later; it's a rule of the system that makes the error physically impossible to occur within the model.
The paper states that under this model, "the confused deputy condition cannot be satisfied as valid model behavior." It's not a "maybe"; it's a "never."

Why This Matters for AI and Robots

The paper highlights that this is super important for AI agents. Imagine an AI assistant that you ask to "summarize a document."

Old Way: The AI might have a "delete file" key in its pocket. If you accidentally type a prompt that tricks it, it might use its own "delete" key to delete your files, thinking, "I have the key, so I can do it."
New Way (Proof-of-Continuity): The AI checks the river. It sees that the "summarize" request only brought a "read" key. Even if the AI has a "delete" key in its pocket, it can't use it for this task because the "delete" privilege wasn't in the original stream of water from the source. The river simply doesn't flow that way.

The Bottom Line

The paper introduces a new way to think about permission. It's not about who you are or what you are holding right now. It's about where you came from and what you were allowed to do at the very start.

By treating authority as a continuous, shrinking river rather than a static object you carry, the paper proves that you can mathematically guarantee that no step in a chain can ever do something the original request didn't allow. It turns a security problem into a simple rule of flow: You can't create new permissions out of thin air; you can only pass down what you were given.

Technical Summary: Proof-of-Continuity: A Temporal Model for Authority Propagation in Distributed Systems and AI Agents

1. Problem Statement

The paper identifies a fundamental limitation in current authorization models, specifically Proof-of-Possession (PoP) and capability-based systems, when applied to discrete, multi-hop execution chains (e.g., distributed services, AI agent tool invocations).

In PoP models, authority is derived from the possession of artifacts (tokens, credentials, capabilities). While these models effectively constrain who may present an artifact, they fail to guarantee that the authority exercised at a later step is a causal continuation of the authority context established at the origin of the request.

This gap leads to the Confused Deputy problem in distributed contexts. A deputy (executor) may hold multiple authority sources (ambient privileges, delegated tokens, bearer credentials). If the deputy processes a request and, based on the request's parameters, exercises a privilege it holds but which was not part of the request's origin authority context, a security violation occurs. The deputy is "confused" because it executes an action causally triggered by a user who lacked the authority to cause that action, yet the deputy possessed the necessary privilege independently.

The paper argues that possession-based models are lineage-invariant: they treat an event $(o, r)$ (operation $o$ on resource $r$ ) as valid solely based on the possession of the privilege, ignoring the temporal lineage $\ell$ that produced the event. Consequently, they cannot distinguish between a valid continuation of an authorized lineage and an unauthorized execution that merely happens to possess the same privilege.

2. Methodology and Model Definition

The authors introduce the Provenance Identity Continuity (PIC) model and the Proof-of-Continuity (PoC) discipline to address this temporal gap.

Core Formalism

Execution Chain: Execution is modeled as a causal chain of steps $\pi = \langle (s_0, C_0), (s_1, C_1), \dots, (s_n, C_n) \rangle$ , where $s_i$ is a step and $C_i$ is the authority context (a subset of privileges $O \times R$ ) carried at that step.
Proof of Relationship (PoR): A single-hop causal primitive. $PoR(s_i, s_{i+1})$ asserts that step $s_{i+1}$ is a valid causal continuation of $s_i$ within the same lineage.
Monotonic Authority Restriction: A valid transition requires that the authority context at the next step is a subset of the current step: $C_{i+1} \subseteq C_i$ . Authority can only be attenuated (restricted), never expanded.
Proof of Continuity (PoC): Defined as the transitive composition of PoR and monotonic restriction across the entire chain. $PoC(\pi)$ holds if every adjacent transition is valid.

Theoretical Framework

The paper formalizes the distinction between Possession and Continuity using a projection argument:

Possession-based policies are defined as functions invariant under lineage: $A(o, r, \ell) = \bar{A}(o, r)$ . They project the event space $E = O \times R \times L$ onto $O \times R$ , discarding the lineage coordinate $L$ .
Theorem 3: Lineage-invariant policies cannot individuate occurrences. Two events with identical privileges but different lineages (one authorized, one confused deputy) receive the same authorization verdict.
Theorem 5 (Trade-off): A system cannot simultaneously satisfy:
1. Lineage-invariant authorization.
2. Authority-mixing-capable delegation (executors holding independent authority sources).
3. Confused-deputy safety.
  To ensure safety in systems requiring authority mixing, the model must relinquish lineage-invariance, making authorization lineage-sensitive.

3. Key Contributions

Proof-of-Continuity (PoC): A minimal authority-propagation discipline where authority is defined not as a static property of an entity, but as a temporal property of an execution chain. Authority exists only as a non-expansive continuation of the origin context.
Formalization of the Confused Deputy as a Lineage Mismatch: The paper reframes the confused deputy not merely as a separation of designation and authority (the spatial view of capabilities), but as a collision of distinct lineages under a projection that forgets time.
Impossibility Results:
- Theorem 3: Proves that lineage-invariant possession cannot distinguish between valid continuations and confused deputy executions.
- Theorem 6: Proves that under the PIC model, the confused deputy condition is impossible to satisfy as valid behavior. If a privilege is absent from the origin context $C_0$ , it cannot appear in any subsequent context $C_n$ within a valid PoC chain.
Distinction of Primitives: Clarifies the roles of:
- Proof-of-Possession: Proves control over an artifact.
- Proof-of-Relationship: Proves causal linkage between adjacent steps.
- Proof-of-Continuity: Proves authority propagation without expansion across the whole lineage.

4. Results and Safety Guarantees

The primary result is the safety of the PIC model. Under Proof-of-Continuity:

Origin-Bounded Authority: Any privilege exercised at hop $n$ must have been present in the origin authority context $C_0$ .
Irreversible Attenuation: If a privilege is dropped at any hop $j$ (i.e., not included in $C_j$ ), it is lost forever and cannot reappear at any later hop $k > j$ .
Elimination of the Confused Deputy: The model structurally prevents the confused deputy condition. An executor cannot exercise a privilege triggered by a request if that privilege was not authorized in the request's origin context, regardless of what other privileges the executor holds.

The paper demonstrates that this safety is achieved by relinquishing lineage-invariance. Authorization decisions must read the lineage coordinate (via PoR evidence) to determine if an action is a valid continuation of the causing request.

5. Significance and Scope

The paper positions Proof-of-Continuity as a modeling refinement rather than a replacement for existing mechanisms like OIDC, wallets, or bearer tokens.

Complementarity: Identity and authentication mechanisms remain essential for establishing the origin. PoC addresses how authority propagates after the origin is established.
Relevance to AI Agents: The model is explicitly highlighted as critical for AI agents, which often hold multiple authority sources (service credentials, user tokens, tool scopes) and execute chains of tool invocations. PoC ensures that an agent cannot use a tool to perform an action (e.g., delete a file) if the user's original intent (e.g., summarize a document) did not authorize that action, even if the agent possesses the delete privilege independently.
Temporal vs. Spatial: The paper argues that while capability models solve the spatial problem of designation, they often fail the temporal problem of multi-hop propagation unless the capability is treated as a held artifact (which reverts to possession). PoC extends the "by-construction" guarantee of capabilities across multi-hop lineages by treating authority as a continuous, non-expansive flow.

The paper concludes that the confused deputy is not a runtime vulnerability to be patched, but a structural impossibility in a valid PIC execution. The model shifts the burden from runtime vigilance to a discipline where authority is defined strictly by its causal history.