Researchers demonstrate that AI agents need dual-layer execution controls, not just policy decisions, to prevent unauthorized command replay attacks

Most AI agents treat a policy decision as sufficient permission to execute, lacking proper execution boundaries between authorization and action

The proposed system separates decision-making from execution: agents request authorization from an external policy engine and receive a signed decision artifact

Local verification and replay protection occur at the execution boundary (PEP), preventing the same signed decision from being executed twice without new authorization

A signed decision alone is not a permission to execute—execution must be enforced where side-effects actually occur, not just upstream in policy engines

Current agent safety systems primarily log decisions and block obvious bad cases, but lack the architectural separation needed to prevent replay attacks