A new system for governing enterprise AI agents is designed to keep raw identifying parameters out of parts of the authorization and audit process. Instead, the policy engine receives the predicates it needs for a decision, while the ledger records a cryptographic commitment to the original parameters. The central question is whether those two jobs can be separated without losing an auditable record.
The system is described as implemented and running through private pilots rather than as a general release. The supplied evidence therefore concerns a working governance design, not a broad deployment.
A commitment before minimization
The design starts with the client calculating a hash, or digital fingerprint, of the complete raw parameter object before any minimization takes place. A later change to the tiers can alter what is disclosed without altering that initial commitment. The authors report that minimization was added to a populated chain while earlier entries remained verifiable.
Fields are classified statically for each action type in three tiers. Policy fields cross in raw form. Derived fields cross only as non-identifying projections, or transformed views. Payload fields stay inside the workload.
The implementation reports five pure projections, each individually unit-tested and compiled into every client. Its test controls include hand-written golden literals and a whole-output check that looks for identifying values under any key.
One rule, with an important qualification
The tier table, policy schema and wire schema are generated from one shared declaration for each action. The strongest no-disagreement guarantee is therefore by construction for the primary client language, while the secondary software development kit relies on conformance testing.
The proposed attestation model assigns facts according to whether their falsification could be detected. The client supplies the parameter digest, the server supplies the action definition, and the client reports the tiers it applied for comparison by the server. That arrangement still leaves the client’s digest claim as a point of trust.
Less disclosure is not the same as less authority
One of the paper’s clearest warnings is that authorization and disclosure are different controls. A deny-by-default policy can protect authorization, but it does not protect disclosure when a field is re-tiered and allowed requests continue. Permission to perform an action does not by itself settle which parameter values may be exposed.
The system includes an optional workload-side disclosure floor. It can narrow catalog disclosure to the payload tier, but it cannot widen what the catalog permits. The control is off by default.
Projections still carry clues
Projection is not a guarantee that no clues cross the boundary. The leakage analysis says endpoint hosts can reveal sensitive service categories, while route templates can reveal the purpose of a request or preserve a semantic identifier that looks syntactically ordinary.
The document also reports an implementation problem involving a resource path. An identifier survived segment-wise templating. The recorded design projects resource paths to a directory rather than exposing a templated full path.
The unresolved trust question
An auditor can check a candidate parameter set against the digest reported by the client, but the mediator cannot establish that the client computed the digest over the actual parameters it used. The result is an auditable commitment whose connection to the client’s real input still depends on trust.
The reported approach is consequently a structural design with specific checks and known failure modes. Its projections can limit disclosure, but the leakage analysis shows that transformed fields may still expose categories, purposes or identifiers. The resource-path incident shows why those projections require testing rather than assumption.
A reference implementation is planned for MIT release but was not available at the time of writing. The planned verification surface includes the five projections, the per-action tier declaration format and the applied-tiers digest, while mediator internals, the policy corpus and the catalog registry API are excluded. The front matter identifies the document as an arXiv preprint in cs.CR.
Paper data and sources
Original title: Separating Disclosure from Authorization: Field-Tier Minimization for Agent Action Mediation
Authors: Jiten Oswal, John Cadeddu
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text