Approval interfaces for record only the entry command or tool call, but the workflow it activates (e.g., package installation running lifecycle hooks) can cross a wider operational boundary. The durable record faithfully names the invocation yet omits these transitive effects, a failure the paper calls approval laundering.
The authors formalize closure-bound approval over six effect classes and derive an information limit: no record-only policy can guarantee correct decisions when identical policy-visible fields require different effect-specific approvals. They build the Approval-to-Action Security Benchmark with 111 fixed approval-object/trace pairs. Using command semantics and decision-time metadata reduces residual records from 40 to 17 to 13. For prospective recovery, they propose effect-bound records with frozen, source-backed predictions; on 17 prespecified holdout workflows, predictions achieve 0.926 macro recall and 0.941 macro precision, cutting residual effects from 10 to 3.
This work is interesting because it shows that truthful invocation identity can hide security-relevant effects, making current approval records systematically incomplete. The results motivate a design requirement: bind each invocation before authorization with a prediction of its transitive effect boundary and provenance, and preserve that binding with the decision.