Risk-Bounded Authorization and Runtime Verification for AI Agents Executing Sensitive Financial Operations
Article Sidebar
Main Article Content
Abstract
AI agents are increasingly used to initiate or approve sensitive financial operations such as transfers, settlements, and limit changes. Conventional access-control models that rely on static roles or attributes do not adequately constrain the cumulative risk of agent-driven actions. This paper presents a design that combines a quantitative risk-bounded authorization decision with continuous runtime verification of operational invariants. Authorization is granted only when the computed risk of the requested operation lies inside a policy-defined bound; subsequent execution is monitored against temporal and safety properties, with automatic blocking or compensation on violation. Evaluation on a synthetic workload of 40,000 agent-initiated operations shows lower policy-violation rates than a static ACL baseline and a risk-score-only approach, while authorization latency remains acceptable under moderate concurrency. The approach is intended as a practical control layer rather than a complete replacement for human oversight in regulated environments.
Article Details
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
References
[1] H. F. Atlam, M. A. Azad, M. O. Alassafi, A. A. Alshdadi, and A. Alenezi, “Risk-based access control model: A systematic literature review,” Futur. Internet, vol. 12, no. 6, p. 103, 2020, doi: https://doi.org/10.3390/fi12060103.
[2] D. R. dos Santos, R. Marinho, G. R. Schmitt, C. M. Westphall, and C. B. Westphall, “A framework and risk assessment approaches for risk-based access control in the cloud,” J. Netw. Comput. Appl., vol. 74, pp. 86–97, 2016, doi: https://doi.org/10.1016/j.jnca.2016.08.013.
[3] H. F. Atlam, R. J. Walters, G. B. Wills, and J. Daniel, “Fuzzy Logic with Expert Judgment to Implement an Adaptive Risk-Based Access Control Model for IoT,” Mob. Networks Appl., vol. 26, no. 6, pp. 2545–2557, 2021, doi: 10.1007/s11036-019-01214-w.
[4] M. Qiu, K. Gai, B. Thuraisingham, L. Tao, and H. Zhao, “Proactive user-centric secure data scheme using attribute-based semantic access controls for mobile clouds in financial industry,” Futur. Gener. Comput. Syst., vol. 80, pp. 421–429, 2018, doi: https://doi.org/10.1016/j.future.2016.01.006.
[5] N. Baltaci Akhuseyinoglu and J. Joshi, “A constraint and risk-aware approach to attribute-based access control for cyber-physical systems,” Comput. Secur., vol. 96, p. 101802, 2020, doi: https://doi.org/10.1016/j.cose.2020.101802.
[6] M. Leucker and C. Schallhart, “A brief account of runtime verification,” J. Log. Algebr. Program., vol. 78, no. 5, pp. 293–303, 2009, doi: https://doi.org/10.1016/j.jlap.2008.08.004.
[7] K. Havelund and D. Peled, “Runtime Verification: From Propositional to First-Order Temporal Logic,” in Runtime Verification, C. Colombo and M. Leucker, Eds., Cham: Springer International Publishing, 2018, pp. 90–112. doi: https://doi.org/10.1007/978-3-030-03769-7_7.
[8] A. Bauer, M. Leucker, and C. Schallhart, “Runtime Verification for LTL and TLTL,” ACM Trans. Softw. Eng. Methodol., vol. 20, no. 4, pp. 1–64, Sep. 2011, doi: 10.1145/2000799.2000800.
[9] M. Leucker, “Runtime Verification for Linear-Time Temporal Logic,” in Engineering Trustworthy Software Systems, J. P. Bowen, Z. Liu, and Z. Zhang, Eds., Cham: Springer International Publishing, 2017, pp. 151–194. doi: https://doi.org/10.1007/978-3-319-56841-6_5.
[10] K. Havelund, G. Reger, and G. Roşu, “Runtime Verification Past Experiences and Future Projections,” in Computing and Software Science, B. Steffen and G. Woeginger, Eds., Cham: Springer International Publishing, 2019, pp. 532–562. doi: 10.1007/978-3-319-91908-9_25.
[11] H. Garcia-Molina and K. Salem, “Sagas,” ACM Sigmod Rec., vol. 16, no. 3, pp. 249–259, 1987, doi: 10.1145/38714.38742.
[12] P. Helland, “Life beyond Distributed Transactions: an Apostate’s Opinion,” in CIDR, 2007. [Online]. Available: https://www.cidrdb.org/cidr2007/papers/cidr07p15.pdf