{"as_of":"2026-08-10T11:55:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:aa0ccacc9c7305d48a28da3a802e1e45362d383d05e6ea727e9ecd733481111d","coverage":[{"denominator":29,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":29,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-02T10:32:34.305658Z","state":"measured"},{"denominator":31,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":31,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T21:46:23.178867Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-08-07T21:46:23.228007Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2606.22916","snapshot_observed_at":"2026-08-01T02:43:24.437055Z","title":"Intent-governed tool authorization for AI agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.25364","last_updated":"2026-07-29T15:58:19Z","snapshot_observed_at":"2026-08-03T10:57:39.774248Z","submitted_at":"2026-07-28T07:16:12Z","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-01T02:43:24.437055Z"},"links":{"cited_paper":"/paper/2606.22916","citing_paper":"/paper/2607.25364"},"observation_digest":"sha256:d4952794c2ada3e3f0a8dc37f21e245f11fdd0fe13dc79f1182d37bcf7d79691","observation_id":"889e1901-795c-4aed-8869-f65b2837f1dd","resolution":{"observed_at":"2026-08-01T02:43:24.437055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"cited_work":{"arxiv_id":"2606.22916","doi":null,"metadata_source":"pith","pith_arxiv_id":"2606.22916","snapshot_observed_at":"2026-08-07T21:46:23.228007Z","title":"Intent-Governed Tool Authorization for AI Agents","venue":"cs.AI","work_id":"b3b6a90e-1e94-4c84-8ae5-5a31f133ad54","year":2026},"citing_paper":{"arxiv_id":"2608.05884","last_updated":"2026-08-06T11:06:06Z","snapshot_observed_at":"2026-08-09T23:11:46.910186Z","submitted_at":"2026-08-06T11:06:06Z","title":"The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-07T21:46:23.178867Z"},"links":{"cited_paper":"/paper/2606.22916","citing_paper":"/paper/2608.05884"},"observation_digest":"sha256:9735ee8427c5146aaeb45dd93ac990afb2c3207962a0edd9af571df00bc387aa","observation_id":"fdc261ba-1e82-46d5-a9b2-c2aa5dc85c59","resolution":{"observed_at":"2026-08-07T21:46:23.233895Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2606.22916/citation-record","integrity":"/paper/2606.22916/integrity","json":"/paper/2606.22916/citation-record.json","paper":"/paper/2606.22916"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.190015Z","title":"Mitchell, and Helen Nissenbaum","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.190015Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:135071238994999a85405af5e5d9660a09059174c5e8cec440bcbed5e6d3d892","observation_id":"35e4b550-9009-4b6e-a0c5-77af0bd29a83","resolution":{"observed_at":"2026-08-02T10:32:34.190015Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.195425Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.195425Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:4a90f8c5b5507714ad56b95f5f9a61b9419058e96f7a57897930b92c00fba5aa","observation_id":"4ad0b115-7c52-4a14-bf3e-af0d0a81cb75","resolution":{"observed_at":"2026-08-02T10:32:34.195425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.200454Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.200454Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:992cd209c7707724485e3efb52fea53da77d682ecd947a0cf1d039298bf6685f","observation_id":"e6925ba9-b5db-4f60-947d-7fd4af1dd12e","resolution":{"observed_at":"2026-08-02T10:32:34.200454Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.204718Z","title":"Ferraiolo and D","venue":null,"work_id":null,"year":1992},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.204718Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:8e69859c6bee00791bb64d72953c95249b42cb4d7d5764068716ba95539df020","observation_id":"1d6554e7-29dd-475e-b524-7a9b20ba8dd0","resolution":{"observed_at":"2026-08-02T10:32:34.204718Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.209047Z","title":"Operationalizing Contextual Integrity in Privacy-Conscious Assistants, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.209047Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:bf40ae1cab9d05d47f47ce7729003b702c13fd133f6e59189a5f913a8d7dd424","observation_id":"d0f6652c-2c24-4d45-a1d0-def0189e696e","resolution":{"observed_at":"2026-08-02T10:32:34.209047Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.213183Z","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.213183Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:537ddbedcf3e42d523086c07a8c917a38c4f6d98fee6db1877442ecf6650094c","observation_id":"5148af58-0ae0-44f1-8027-39fb613b014a","resolution":{"observed_at":"2026-08-02T10:32:34.213183Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.217976Z","title":"Hu, David Ferraiolo, D","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.217976Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:2f681ce38420a354aaea9c6df4516854d4cf5fb5dbfbfd3809d229fb6a5d5bf3","observation_id":"95a6121f-b61e-4f21-abb2-81c8b95b9eee","resolution":{"observed_at":"2026-08-02T10:32:34.217976Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.221964Z","title":"Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.221964Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:5665b7710f8fe9e99c13cb1f48c089a1fda1945cfa50d02b7532d287d8b8b774","observation_id":"aadee338-8424-4dab-bc4b-2a7b4a7e7a9d","resolution":{"observed_at":"2026-08-02T10:32:34.221964Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.226055Z","title":"Need to Know: Contextual-Integrity-Grounded Query Rewriting for Privacy-Conscious LLM Delegation, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.226055Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:0f33a48645960aa38b3c892f02db9f76cc50a001a3f6f030c097febe9a847111","observation_id":"155969ce-f6d2-48af-b01b-39ac1b6ec51a","resolution":{"observed_at":"2026-08-02T10:32:34.226055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.230584Z","title":"Securing the Model Context Protocol: Defending LLMs Against Tool Poisoning and Adversarial Attacks, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.230584Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:9cc5a9a242e50f2ce8fb3190c758e0da77af88f2a4d4d9f2764421564f549745","observation_id":"fc683ac0-ffc0-49de-bb82-d0b72c09f240","resolution":{"observed_at":"2026-08-02T10:32:34.230584Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.234585Z","title":"AgentDyn: A Dynamic Open-Ended Benchmark for Evaluating Prompt Injection Attacks of Real-World Agent Security System, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.234585Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:ff005d0af2a15af23ee423288f9e12a4bab7a5ef7224dbeda52ffd4b864ef5af","observation_id":"04527dff-7c3f-442d-a8ec-6f0de9fb2625","resolution":{"observed_at":"2026-08-02T10:32:34.234585Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.238425Z","title":"ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilities, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.238425Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:0b00bf16de47190cc915cbc5fefbe683ce90777c62ca9280211f82fff938573a","observation_id":"07390d51-9322-4ebd-b180-551a78573fc9","resolution":{"observed_at":"2026-08-02T10:32:34.238425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.242656Z","title":"Authorization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.242656Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:850d21e854a874bd3973723af127e819f29954304c52ab9c9d2de01b9c4bcd07","observation_id":"f1ba5f8d-8550-411d-af00-4b72ce3fe447","resolution":{"observed_at":"2026-08-02T10:32:34.242656Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.246480Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.246480Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:6684f3f13ed280753a398927f5f9d0ed4087c0139180ba81a8ba074e5c42d110","observation_id":"ce07bee1-4c59-4d39-846f-8db0deceea91","resolution":{"observed_at":"2026-08-02T10:32:34.246480Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.250987Z","title":"Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.250987Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:20dd08290860802159ff2a41494438a9f69d581147b4620faded5dbe68e69952","observation_id":"4305c0a2-561c-46c6-a159-87cd8ffc45bb","resolution":{"observed_at":"2026-08-02T10:32:34.250987Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.254698Z","title":"Stanford University Press, 2009","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.254698Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:070c14df3e912b751079e4ec622e7e10db1798ee08ba7dd7a35cc5ea31d2fe4f","observation_id":"317a95c7-4542-42b8-965f-5bcff794f96d","resolution":{"observed_at":"2026-08-02T10:32:34.254698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.258538Z","title":"LLM01:2025 Prompt Injection","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.258538Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:db8e40d67c8923c39aba2d2df7d3afd2291caa4a1cbb4d52f599e3009fc47955","observation_id":"248fada8-082e-454e-bf66-5b1528e87fe2","resolution":{"observed_at":"2026-08-02T10:32:34.258538Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.262506Z","title":"OW ASP Top 10 for LLM Applications 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.262506Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:728488134a3aee9cbf14043830a8bb3c5427049f63a30c96c3ed0c1860b477ef","observation_id":"ea0dbd09-bbb0-40bd-b484-24a0b327d865","resolution":{"observed_at":"2026-08-02T10:32:34.262506Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.266439Z","title":"Maddison, and Tatsunori Hashimoto","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.266439Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:616a436b240692fcc2b05a09b03505b366785d9fd13e036acfc6fc251dbf1e92","observation_id":"12854581-b907-4f19-8917-076c26188621","resolution":{"observed_at":"2026-08-02T10:32:34.266439Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.270482Z","title":"Saltzer and Michael D","venue":null,"work_id":null,"year":1975},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.270482Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:1541d8e26eccf09d8d662a700601f33c2327ab25d4824d964eefb6f6dcff47e9","observation_id":"24193b09-c495-4e28-a941-85aa18df27b7","resolution":{"observed_at":"2026-08-02T10:32:34.270482Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.274818Z","title":"MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.274818Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:eba80c9dd5ca618e4ade3506c0e09fee02d33bab4bbf40fb2ef1e26f0b97f777","observation_id":"18747825-aa31-4fc9-846d-f4d8f8e1e8e5","resolution":{"observed_at":"2026-08-02T10:32:34.274818Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.278453Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.278453Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:b3194606207d21339ef7c525209ac678406b1b6cc3873ba4756322933a7e4aa1","observation_id":"eebae825-626a-4ea0-84ab-2ac6ce20bfb7","resolution":{"observed_at":"2026-08-02T10:32:34.278453Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.282521Z","title":"ToolTweak: An Attack on Tool Selection in LLM-based Agents, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.282521Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:ea04535848bfad3285f6c15ed91aa413f1eb8b5e63466b3c6219887657b6f9d4","observation_id":"00621fd8-9e55-4b4d-bda7-b74ec9383132","resolution":{"observed_at":"2026-08-02T10:32:34.282521Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.286490Z","title":"Data Guard: A Fine-grained Purpose-based Access Control System for Large Data Warehouses, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.286490Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:2047708f42b901f95b2e59f333943d7b869c1ca6019477ae05940c8fadd90560","observation_id":"98643bf9-498f-43c6-9087-381d3c6661fd","resolution":{"observed_at":"2026-08-02T10:32:34.286490Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.290321Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.290321Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:5890ca09cee417586a40f980ba0b31bafaf16d3a0ebd555338b9fdcef48597e8","observation_id":"e214b054-0206-4d5e-b16d-f35e9c1af57b","resolution":{"observed_at":"2026-08-02T10:32:34.290321Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.294081Z","title":"Messaging with Purpose Limitation – Privacy-Compliant Publish-Subscribe Systems, 2021","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.294081Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:d04854bbcf304988705bc019215c1760d1869520e565b3ef4fba7c7802e419ba","observation_id":"16334e18-31fb-4d43-803b-2114a0d375c8","resolution":{"observed_at":"2026-08-02T10:32:34.294081Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.297969Z","title":"τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.297969Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:c45bde4bc14a876907ce44f0b198346275e6f10cf28f3e5c02728b434448d727","observation_id":"cf519791-baee-479a-aa36-7bbec0918fb1","resolution":{"observed_at":"2026-08-02T10:32:34.297969Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.301794Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.301794Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:0a02c7a9f6fe8f645dbf3464d314d5155c3ec9ed208d17218c02b21058035499","observation_id":"425f23c7-a4f1-4650-9752-c017d720c82f","resolution":{"observed_at":"2026-08-02T10:32:34.301794Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T10:32:34.305658Z","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents","version":3},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-02T10:32:34.305658Z"},"links":{"citing_paper":"/paper/2606.22916"},"observation_digest":"sha256:471286f6d932dc78c7ae94cb37202b7ee27e2525b537b9c20e5b4a994ebee6c9","observation_id":"b8d8d1d6-3e6d-47e0-b085-4800c10f72d7","resolution":{"observed_at":"2026-08-02T10:32:34.305658Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2606.22916","last_updated":"2026-07-29T14:54:52Z","latest_version":3,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-09T10:57:47.685226Z","submitted_at":"2026-06-22T06:55:57Z","title":"Intent-Governed Tool Authorization for AI Agents"},"reference_resolution":{"displayed":29,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":29,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":29},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 29 of 29 outbound references and 2 inbound Pith citation observations for arXiv:2606.22916."}