What remains valid when an agent's environment changes? Matoi studies how to reuse checked consequence evidence without treating it as permission to execute. The research preprint is now on arXiv.
An agent can repeat the same tool call and reach a different consequence. A workflow changes, a destination moves, or a permission expires. The call still looks familiar. The reason to allow it may no longer hold.
Matoi: Selective Revalidation of Consequence Evidence for Agent Authorization is now on arXiv. It asks a practical question: what evidence from an earlier check still applies, and what must be checked again?
Consider a support workflow that refunds a customer and sends a notification. An unrelated configuration change should not necessarily force every consequence analysis to start from scratch. But adding an export step or changing the notification destination can invalidate the earlier analysis, even if the entry-point call is unchanged.
There is a second, separate change: the operator's permission can be revoked while the workflow and its consequences stay exactly the same. Evidence about what a workflow can do is not authority to do it now.
This example motivates the separation. It is not a claim that Matoi can discover every consequence of an arbitrary tool.
Matoi keeps three things separate:
A trusted consumer checks evidence before retaining it. It may reuse only its own checked evidence while the supporting observations remain valid. Relevant changes require reconsideration; a cache hit is not permission to skip the authorization boundary.
The finite query-aware implementation covers branches, ordered collections and negative lookups. Tracking a missing result matters: if a previously absent destination appears, an earlier conclusion may no longer apply. Incremental analysis and dependency caching are established techniques. Matoi makes their applicability and execution obligations explicit; it does not claim a new general incremental algorithm.
The latest matched-input study contains 1,440 measurement cells repeating 144 authored inputs, not 1,440 independent workflows. With identical compact input bytes, it compares checked-evidence reuse against full rechecking and counts complete lifecycle cost rather than only a warm-cache lookup.
| Consumer | Complete lifecycle cost reduction |
|---|---|
| JavaScript | 3.49% |
| Python | 1.79% |
These are modest reductions in the measured setting. Five of twelve family-level intervals included no improvement in each language. Earlier comparisons also retain cases where a protected cache is cheaper. This is not a claim of zero-cost checking, a universal speedup or superiority over another vendor's production system.
The useful question is not simply whether reuse is possible. It is whether establishing that reuse is still valid costs less than doing the work again.
The paper includes real local processes, cloud reproduction, GitHub side effects and conservative crash recovery. Requests with uncertain remote outcomes are not automatically resent. Local dispatch does not establish atomic commitment at a third-party API, and revocation after admission remains a distinct boundary.
A prospectively frozen AgentDojo Banking mapping covers 5 of 16 user plans and 7 of 9 attack plans. Both governed strategies preserve five exact benign transfers and refuse 35 reused attack-plan/policy combinations. Those are not 35 independent attacks. The study executes AgentDojo's original scripted synthetic tools, not autonomous agents or a real bank. Already-satisfied task predicates are reported separately from newly completed work.
Separate JavaScript and Python consumers test interoperability within the same project, not independent external validation. Unsupported tools, incomplete deployment visibility and remote commitment remain explicit limits.
CAVA represents the action. PCAA addresses governance authority and proof. BAF contributes bounded approval checks; AREG organizes runtime exposure and evidence. Matoi connects these questions around the continued applicability of consequence evidence, without making a graph or a signature sufficient proof of coverage.
ZeroGate explores moving preparation away from the final dispatch boundary. Matoi asks which evidence can remain useful between preparations. These are complementary questions, not interchangeable speed measurements. This publication is a research release, not a product rollout or a claim that Matoi is enabled in hosted OSuite Studio.
Start with the 18-page technical manuscript, or read the full 55-page preprint for the study history, counterexamples and detailed accounting. The work is not peer reviewed. These links provide the published manuscripts, not a public runnable evidence package.
If you build agent runtimes, we would welcome a technical discussion: which workflow makes evidence difficult to reuse, and which change should invalidate it? A concrete counterexample is more useful than an endorsement. Reuse should earn its place without weakening the decision that follows it.
Request enterprise access and send your first governed decision today.
