Compofence — Provenance-Bound Delegation Contracts in Multi-Agent Pipelines

Status: Full run complete · part of the agent-authorization and tool-security line of work.

The question

Does per-step authorization, applied correctly at every hop, still permit an end-to-end unauthorized release that only a provenance-bound delegation contract can block? Compofence measures that composition gap directly across 80 scenario roots, delegation depths of 2, 3 and 4, six attack families (malicious document, forged delegation, purpose drift, confused deputy, unlabeled summarization) and six baselines, with heterogeneous agents held to one resident model at a time.

Results so far

• The attack surface is real and large when undefended. The no-defense baseline reaches an unauthorized-release rate of 0.889 (640 of 720) while keeping authorized task success at 0.997 — the pipeline does the wrong thing without breaking the right thing, which is what makes the failure easy to miss.
• The hypothesized composition gap did not appear. Field-level authorization records an unauthorized-release rate of 0.000; Compofence records 0.0069; the gap is −0.0069, where the hypothesis predicted a positive value. Per-step field authorization was sufficient in this configuration, and the delegation contracts had no residual failure to catch.
• This is reported as a negative rather than reframed. The design predicted a gap, the pre-registered metric measured its absence, and the useful next question is whether the gap opens at delegation depths beyond 4 or under attack families that defeat field-level checks specifically.